CVE-2025-6934

CVE-2025-6934 🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to Privilege Escalation in all version...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...

CVE-2026-96387

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6...

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and...

CVE-2025-57819

CVE-2025-57819 Overview of this vulnerability quoted from @jfinstrom here Around 2025-08-21 multiple FreePBX systems began showing errors and later confirmed compromises. Vendor Sangoma/FreePBX Security Team published an advisory on 2025-08-26 urging administrators to restrict public access to th...

CVE-2026-114633

The software WWBN AVideo versions prior to 29.4.0 is vulnerable to an incorrect authorization vulnerability. An attacker with delegated Users Admin privileges can target administrator accounts through the confirmDeleteUser.json.php or userAddNew.json.php endpoints. Successful exploitation allows ...

EUVD-2026-107888

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

CVE-2026-96387 Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6...

EUVD-2026-107818

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6...

CVE-2026-96387

The Stop administrator login module for Drupal (versions 1.0 to 1.6 ) is vulnerable to an Authentication Bypass (CWE-288) because it fails to sufficiently enforce access restrictions across all supported authentication mechanisms. A blocked administrative user (such as user 1 or those with the ad...

PT-2026-121505

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.87.0 through 1.100.3 LiteLLM versions 1.101.0 through 1.101.2 LiteLLM versions 1.102.0 through 1.102.1 LiteLLM versions 1.103.0 LiteLLM versions 1.104.0-rc.0 through 1.104.0-rc.1 Description LiteLLM reuses a single...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2024-6624 vulnerability in the JSON API User = 3.9.3 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileges to...

CVE-2026-24291

CVE-2026-24291 Obfuscated version of RegPwn https://www.mdsec.co.uk/2026/03/rip-regpwn/ Added extra functionality that it wiill automatically create a local administrator with generated credentials. You can re-compile the payload with code execution as administrator as desired. Steps - Compile th...

CVE-2026-113779

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST...

CVE-2026-113779 pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST...

CVE-2026-113779

The pfSense REST API package (pfSense-pkg-RESTAPI) is vulnerable to a privilege escalation flaw in versions prior to 2.9.0 . Authenticated accounts with the dedicated settings sync permission can modify REST API configuration secrets, allowing a non-administrative user to gain full administrator ...

EUVD-2026-107283

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST...