Lucene search
+L

168952 matches found

NVD
NVD
added 2026/09/05 7:17 a.m.7 views

CVE-2026-84926

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

2.7CVSS0.00189EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/05 7:17 a.m.5 views

CVE-2026-84225

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...

2.2CVSS0.00147EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/05 7:17 a.m.7 views

CVE-2026-84745

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

2.7CVSS0.00189EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/05 7:17 a.m.7 views

CVE-2026-81348

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

3.7CVSS0.00216EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/05 6:47 a.m.4 views

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197 I was presented with a high-severity alert indicating a potential exploit attempt of CVE-2023-22515, a zero-day vulnerability in Atlassian Confluence. The alert showed a suspicious GET request from an...

10CVSS8.5AI score0.99156EPSS
SaveExploits40
CVE
CVE
added 2026/09/05 6:00 a.m.18 views

CVE-2026-84926

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) contains an insufficient access control flaw in one of its Google Reviews REST routes , which should be restricted to administrators but is accessible to any authenticated user with contributor-level privileges or above . This allows such us...

2.7CVSS5.2AI score0.00189EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/05 6:00 a.m.31 views

CVE-2026-84927 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

0.00168EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.8 views

EUVD-2026-71870

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

5.3AI score0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/05 6:00 a.m.33 views

CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

0.00189EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.8 views

EUVD-2026-71869

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

5.2AI score0.00189EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.9 views

EUVD-2026-71864

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

5.3AI score0.00189EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.7 views

EUVD-2026-71863

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...

5.3AI score0.00147EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/05 6:00 a.m.8 views

EUVD-2026-71852

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

5.1AI score0.00216EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/05 6:00 a.m.10 views

CVE-2026-15247

CVE-2026-15247 affects the Search Atlas SEO WordPress plugin in versions prior to 2.6.24 . The root cause is a missing nonce or capability check before processing a settings update in one of the plugin's early-priority handlers. This allows any authenticated user at the Subscriber level or above ...

5.4CVSS5.3AI score0.00209EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/05 5:25 a.m.6 views

smart-contract-attack-vectors

Smart contract attack vectors The goal of this repository is to compile all possible smart contract vulnerabilities and resources for learning about them. Feel free to submit a pull request, with anything from small fixes to docs or tools you'd like to add. List of Security Vulnerabilities Access...

6AI score
SaveExploits0References68
Kitploit
Kitploit
added 2026/09/05 4:48 a.m.7 views

CVE-2025-65672

CVE-2025-65672 Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows unauthorized share and invite access to course settings. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered by: Rivek Raj Tamang RivuDon, Sikkim, India Vulnerability Details Insecure Direct Object...

7.5CVSS5.9AI score0.00354EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/05 4:16 a.m.4 views

CVE-2025-65670

CVE-2025-65670 An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the...

4.3CVSS5.9AI score0.00244EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/05 3:37 a.m.6 views

CVE-2025-65669

CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...

9.1CVSS5.9AI score0.00472EPSS
SaveExploits1
Positive Technologies
Positive Technologies
added 2026/09/05 12:00 a.m.12 views

PT-2026-86353

🚨 CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress cor...

2.7CVSS5.2AI score0.00189EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/09/05 12:00 a.m.13 views

PT-2026-86415

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description Broken access control in the 'videoViewsInfo' endpoint allows unauthenticated callers to retrieve complete user records when a hash parameter is provided. The exposed data includes password...

9.3CVSS5.7AI score0.00269EPSS
SaveExploits0References6
Rows per page
Query Builder