instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure इंस्टाग्राम प्राइवेट अकाउंट बाइपास - सार्वजनिक खुलासा Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report खोजा गया: 12 अक्टूबर, 202...

CVE-2026-94538

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-15178

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

PoC-CVE-2025-29927

PoC-CVE-2025-29927 o que é a vulnerabilidade? este cve relata uma falha no cabeçalho x-middleware-subrequest, responsável por receber requisições internas no next.js, que permite a um atacante contornar os middlewares de autorização no next.js 15.0.0 e acessar rotas protegidas, por exemplo exempl...

CVE-2022-25262

CVE-2022-25262 PoC + detalhes da vulnerabilidade para CVE-2022-25262 | JetBrains Hub - tomada de resposta SAML com um clique CVE-2022-25262 Requisitos Uso Como funciona? Pool de código de autorização para troca "OAuth2 - SAML" Tomada de código de autorização OAuth2 do YouTrack Konnector por desig...

EUVD-2026-96202

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108...

Ofbiz-RCE

📌 Apache OFBiz RCE Exploit CVE-2024-38856 Este script Python permite explorar uma vulnerabilidade do tipo Remote Code Execution RCE no Apache OFBiz versões 18.12.15, através de um acesso não autorizado ao endpoint /webtools/control/forgotPassword/ProgramExport. 🛠️ Descrição CVE : CVE-2024-38856...

CVE-2025-25257

CVE-2025-25257 - Verificador e Exploit de Vulnerabilidade FortiWeb Uma ferramenta baseada em Python para verificar e explorar a vulnerabilidade CVE-2025-25257 em dispositivos FortiWeb. Esta vulnerabilidade permite injeção de SQL e execução remota de código através de um cabeçalho Authorization...

CVE-2026-94538

The WP File Download plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 6.3.9 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This allows authenticated attackers with subscriber-level a...

EUVD-2026-96217

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-94538 WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-15178

The Fluent Forms plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 6.2.5 . The root cause is the plugin's failure to properly verify if a user is authorized to perform specific actions. This flaw allows authenticated attackers with Custom-level acce...

EUVD-2026-96226

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-15178 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-91050

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CVE-2026-104741

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-104742

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

next-CVE-2025-29927

CVE-2025-29927: Bypass de Autorização no Middleware do Next.js Uma vulnerabilidade crítica no Next.js CVE-2025-29927 permite acesso não autorizado a rotas protegidas ao contornar a lógica do middleware. O problema afeta as versões 11.1.4 a 13.5.6 do Next.js, e as versões 14.x 14.2.25 ou 15.x...