135393 matches found
CVE-2026-96566
The Newsletter – Send awesome emails from WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.4.0 . The root cause is insufficient input sanitization and output escaping within the 'np1' Custom Field Parameter . Unauthenticated attackers can i...
Apache-OFBiz-Directory-Traversal-exploit
Apache-OFBiz-Directory-Traversal-exploit Apache OFBiz 18.12.12...
CVE-2026-97219 MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...
CVE-2026-97219 MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...
CVE-2016-10204_Webshell
CVE-2016-10204Webshell 대상 엔드포인트에 대해 CVE-2016-10204의 수동 익스플로잇을 시연하고 PHP 웹쉘 업로드로 이어지는 bash 스크립트입니다. 현재 webshell 변수는 MySQL 페이로드로 설정되어 있습니다. 이는 대상으로 삼아야 하는 백엔드에 따라 변경할 수 있습니다. 이 CVE에 대한 자세한 정보는 다음 출처에서 확인할 수 있습니다: https://nvd.nist.gov/vuln/detail/CVE-2016-10204 https://www.exploit-db.com/exploits/412...
CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter
CVE-2026-11101 – キーなしクエリパラメータによるHTTPキャッシュポイズニング 概要 WebキャッシュはURLパスのみをキャッシュキーとして使用し、クエリパラメータを無視します。攻撃者は、キーなしパラメータ（例: utmcampaign）に悪意のあるペイロードを追加してキャッシュを汚染する可能性があります。後続の訪問者は、任意のJavaScriptを含む汚染された応答を受け取ります。 脆弱性の詳細 タイプ: Webキャッシュポイズニング 影響: 保存型XSS、認証情報の窃取、改ざん。 根本原因:...
CVE-2026-92174
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...
CVE-2026-85016
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
EUVD-2026-91192
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
CVE-2026-85016
The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape an icon value before concatenating it into an HTML attribute within the shared widget-parameter processor . This flaw allows u...
CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
CVE-2024-12404
CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - 認証なしSQLインジェクション 説明 WordPress用CF Internal Link Shortcodeプラグインは、1.1.0以前のすべてのバージョンにおいて、ユーザーが指定するパラメータのエスケープが不十分で、既存のSQLクエリの準備が十分でないため、'posttitle'パラメータを介したSQLインジェクションに対して脆弱です。これにより、認証されていない攻撃者が既存のクエリに追加のSQLクエリを付加し、データベースから機密情報を抽出することが可能になります。 詳細 タイプ...
EUVD-2026-91178
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...
CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...
EUVD-2026-91174
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-84925
The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...