Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

CVE-2026-81340: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-82885: Missing Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...

PT-2026-95632

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A missing authorization check in the REST API allows a remote authenticated attacker to gain elevated privileges. Recommendations At the moment, there is no information about a newer versio...

WordPress CheckView plugin < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass vulnerability

Administrator Account Creation via REST API Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin CheckView Automated Testing versions 2.3.2...

wp2shell-PoC

wp2shell-PoC ⚠ 本工具仅用于教育或漏洞赏金目的。严禁在受控环境之外未经授权使用。 概述 针对影响 WordPress 核心的 wp2shell 漏洞链的概念验证（PoC），结合了 CVE-2026-63030 和 CVE-2026-60137。该项目演示了 REST API 批量路由混淆漏洞与 WPQuery SQL 注入之间的相互作用，形成一条无需认证即可完全入侵 WordPress 并实现远程代码执行（RCE）的路径。 阅读完整公告此处 工作原理 wp2shell 是 WordPress 核心中的一个认证前 RCE 链，结合了 CVE-2026-63030（批量 RES...

Vulnerabilities found in Cisco Identity Services Engine (ISE)

Cisco has identified 21 vulnerabilities in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC. These vulnerabilities concern various security issues in Cisco ISE and ISE-PIC, including opportunities for unauthorized and low-privilege malicious actors to perform...

CVE-2026-88904

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

EUVD-2026-81348

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-88904

The PuppyFW WordPress plugin (versions

CVE-2026-88904 PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...

CVE-2026-88904: Improper Privilege Management

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby...

CVE-2026-92780

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-76428

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An...

CVE-2026-76426

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-76412

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An...

CVE-2026-76424

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...