16 matches found
CVE-2026-12586 Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user including an administrator and take over the account...
CVE-2019-12586
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266NONOSSDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service crash via a crafted message...
CVE-2025-12586
creationtimestamp| type| source ---|---|--- 2025-11-25 09:16:35+00:00| seen| https://gist.github.com/Darkcrai86/962f16ea6896a63a14961884fe8423e1...
CVE-2025-12586
The CVE concerns the WordPress plugin Conditional Maintenance Mode for WordPress, affecting all versions up to and including 1.0.0. The root cause is missing nonce validation when toggling the maintenance mode status, leading to Cross‑Site Request Forgery (CSRF). This enables unauthenticated atta...
CVE-2024-12586
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-12586
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-12586
creationtimestamp| type| source ---|---|--- 2025-02-13 06:10:17+00:00| seen| https://infosec.exchange/users/cve/statuses/113995088985958672 2025-02-13 06:15:45+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhzzyjusar2z 2025-02-13 07:10:29+00:00| seen|...
CVE-2024-12586 Chalet Montagne Com Tools <= 2.7.8 - Reflected XSS
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-12586
The Chalet-Montagne.com Tools WordPress plugin, specifically versions 2.7.8 and earlier , contains a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitize and escape a parameter before it is output back to the page. This flaw could be exploited to ...
CVE-2019-12586
creationtimestamp| type| source ---|---|--- 2019-09-07 19:19:32+00:00| published-proof-of-concept| https://t.me/techb0ltGenona/947 2019-09-08 19:25:29+00:00| published-proof-of-concept| Telegram/0GL2HLFlH7purPAly9fE9htFJHCPdZf69GXFtJF8IKHA 2021-12-07 03:44:42+00:00| exploited|...
CVE-2019-12586
CVE-2019-12586 affects Espressif ESP-IDF (2.0.0–4.0.0) and ESP8266_NONOS_SDK (2.2.0–3.1.0): the EAP peer processes EAP Success messages before any EAP method completion, enabling a radio‑range attacker to crash the device (DoS) via a crafted message. Red Hat and OSV entries confirm the same descr...
Exploit for CVE-2019-12586
ESP32/ESP8266 Wi-Fi Attacks This repository is part of a re...
CVE-2017-12586
SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users...
CVE-2017-12586
The CVE-2017-12586 issue affects SLiMS 8 Akasia up to version 8.3.1. Affected component: admin/help.php URL parameter handling, where a directory traversal flaw allows arbitrary file reading. It can be exploited by remote authenticated librarian users. The connected sources confirm the vulnerabil...