CVE-2026-18496

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 11.4.3 . The flaw exists within the wpbc_is_show_popover_in_flex_timeline() function, which allows unauthenticated attackers to extract sensitive customer data, including ...

CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Scanner/exploit GUI dark-neon pour CVE-2026-102425 — Balbooa Forms combaforms 1.0.0–2.4.3.3 : RCE non authentifiée via injection de shortcode de champ dans l'action PHP-after-submission eval. Implémentation GUI autonome standalone — réécrite de zéro à partir du...

CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress (versions

EUVD-2026-96051

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

run-gemini-cli

run-gemini-cli Overview run-gemini-cli is a GitHub Action that integrates Gemini into your development workflow via the Gemini CLI. It acts both as an autonomous agent for critical routine coding tasks, and an on-demand collaborator you can quickly delegate work to. Use it to perform GitHub pull...

httpx-action

httpx Action يجعل تنسيق httpx مع GitHub Action أمراً سهلاً. مثال للاستخدام GitHub Action لتشغيل httpx على قائمة المضيفين - name: 💥 httpx - HTTP Web Server probing uses: projectdiscovery/httpx-action@main with: list: hosts.txt مثال لسير العمل : .github/workflows/httpx.yml name: 💥 httpx - HTTP Web...

GitSecure

GitSecure About GitSecure GitSecure is a GitHub action that can be used to alert security teams of any exposed API keys for push and pull requests. When files are added or modified on a GitHub repo, this action will be initiated and will start looking for exposed credentials in the system. After...

unicode-control-characters-action

إجراء أحرف التحكم في Unicode إجراء GitHub للعثور على أحرف التحكم في Unicode باستخدام أداة تشخيص Red Hat https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 للكشف عن هجمات مصدر طروادة RHSB-2021-007 CVE-2021-42574,CVE-2021-42694 المدخلات args مطلوب وسائط البرنامج النصي الموثقة في...

naabu-action

Naabu Action يجعل من السهل تنسيق naabu مع GitHub Action. مثال للاستخدام GitHub Action لتشغيل naabu على قائمة المضيفين - name: 💥 Naabu - Port Scanner uses: projectdiscovery/naabu-action@main with: host: example.com GitHub Action لتشغيل naabu مع فحص مخصص للمنافذ - name: 💥 Naabu - Port Scanner uses:...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

TranslatePress <= 3.3.1 - Unauthenticated Account Takeover

TranslatePress WordPress plugin = 3.3.1 contains a sensitive information exposure caused by the 'trpgettranslationsregular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string savi...

WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS

Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires...

WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

UC Gateway Investment SiteEngine v5.0 - Open Redirect

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action. id: CVE-2008-7269 info: name: UC Gateway Investment SiteEngine v5.0 - Open...

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

SPIP <3.1.2 - Cross-Site Scripting

SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in validerxml.php which allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action. id: CVE-2016-7981 info: name: SPIP 3.1.2 - Cross-Site Scripting author: pikpikcu severity:...

Puppet Server/PuppetDB - Sensitive Information Disclosure

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints, which may contain sensitive information when left exposed. id: CVE-2020-7943 info: name: Puppet Server/PuppetDB - Sensitive Information Disclosure author: c-sh0 severity: high...

WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...