CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación. Recursos...

CVE-2026-14962

CVE-2026-14962 Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection ELEX WooCommerce Request a Quote WordPress plugin elex-request-a-quote ≤ 2.4.0 — unauthenticated SQL injection via the public elexraqaddtoquote AJAX action. For authorized testing only. Do not run this...

CVE-2022-2546

All-in-One WP Migration Versiones afectadas All-in-One WP Migration 7.63 Referencias Sucuri WPSca...

CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated...

EUVD-2026-87133

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

study-turbolinks-link

JavaScript Usage https://github.com/turbolinks/turbolinksapi-reference Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...

CVE-2025-55182-bypass

CVE-2025-55182 Bypass de Cabecera Bypass de la cabecera Next-Action para CVE-2025-55182. Consigue RCE en React RSC sin cabeceras distintivas, evadiendo reglas WAF. Hallazgo Clave La cabecera Next-Action NO es necesaria para la explotación. Vector de ataque| Cabecera Next-Action| Detección WAF...

CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2021-26084

CVE-2021-26084 Alcance de la afectación Versión .jar y en el archivo atlassian-plugin.xml dentro de los archivos JAR de los complementos incluidos. Cada acción contiene al menos un atributo name, que define el nombre de la acción, un atributo class, que define la clase Java que ejecuta la acción,...

CVE-2023-37598

CVE-2023-37598 — issabel-pbx 4.0.0-6: Falsificación de Solicitudes entre Sitios CSRF Resumen CVE ID: CVE-2023-37598 Tipo de vulnerabilidad: Falsificación de Solicitudes entre Sitios CSRF Producto afectado: issabel-pbx v4.0.0-6 Gravedad: Media Descubierto por: Sahil Ojha Fecha de divulgación:...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of...

js-jobs

js-jobs JS Job Manager Para activar un plugin hay una limitación aquí, ya que el plugin debe...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page input type="submit" val...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the...

CVE-2015-10034

CVE-2015-10034 此仓库是为了演示 J-TAS Action 而创建的。 workout-organizer-2aaedb7f69ea398a0217493fefe8f19b31ee0775 文件夹包含与 CVE-2015-10034 相关的脆弱应用程序。 我们已包含 J-TAS Action 执行分析结果的 SARIF 文件。...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus ≤ 2.0.8 — 缺少授权导致已认证（订阅者+）站点重置和权限提升 CVE-2025-14364 — Demo Importer Plus · 全站重置 → 权限提升 / \ / | / \ | /| || | || \ / | / / / | | | | 已认证的订阅者 → 管理员，通过do-reinstall AJAX 动作 〔 1 〕 漏洞 | ---|--- CVE| CVE-2025-14364 CVSS v3.1| 8.8 高 —...

CVE-2021-24499

CVE-2021-24499 | Workreap - Tema de WordPress para Mercado Freelance y Directorio 2.2.2 - Subida de Archivos Arbitraria Tema de WordPress Workreap 2.2.2 - Subida de Archivos No Autenticada que Conduce a Ejecución Remota de Código Una herramienta de explotación masiva potente y precisa para la...