CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2020-5377

CVE-2020-5377 CVE-2020-5377: Dell OpenManage Server Administrator File Read root@kitploit: Usage: python3 CVE-2020-5377.py :...

CVE-2021-37580

CVE-2021-37580 Apache ShenYu Admin Authentication Bypass...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability

Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...

CVE-2022-43959

CVE-2022-43959 Vulnerabilidad de Bitrix CVE-2022-43959 Descripción Credenciales insuficientemente protegidas en la configuración del servidor AD/LDAP del módulo conector AD/LDAP de 1C-Bitrix Bitrix24 antes de la versión 23.100.0 permiten a administradores remotos descubrir la contraseña...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Tot...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2023-0156

CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2020-18326

Subrion CMS 4.2.1 - Cross Site Request Forgery CSRF Add Administrator user Description Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with other applications to create entry level sites, mid-sized or large sites. Cross Site Request Forge...

CVE-2026-82860

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

EUVD-2026-68448

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2021-44228---detection-with-PowerShell

CVE-2021-44228 PowerShell检测 1 打开 automatedscan.ps1，设置变量 $ResultsCSV 和 $Directory 2 保存并关闭文件 3 以管理员身份打开PowerShell，然后运行以下命令： powershell.exe -noprofile -executionpolicy bypass -file .\automatedscan.ps1...

CVE-2026-74252

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass J2Commerce comj2store ≤ 4.1.5 — Unauthenticated Attacker Stores XSS Payload That Executes Automatically in Administrator Browser on Page Load SUMMARY J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the gues...

CVE-2025-68434-OSPOS-CSRF

CVE-2025-68434: CSRF Unauthorized Administrator Creation in OpenSourcePOS...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting

The WordPress File Upload plugin before version 4.24.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back, which could allow attackers to execute arbitrary JavaScript code...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...