CVE-2026-88621

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...

CVE-2026-86729

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-86729: Improper Restriction of Excessive Authentication Attempts

WWBN AVideo through commit e01e41ecc no patched version available exposes getapipreauthorize in plugin/API/API.php as a second, undocumented login path. Unlike getapisignIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit, getapipreauthorize performs the same credentia...

CVE-2026-75465: Improper Access Control

The /api.php/user/getlist endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters t...

CVE-2026-75465

The /api.php/user/getlist endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters t...

CVE-2026-19376 Uasoft Badaso File API api.php class permission

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-68326

Name of the Vulnerable Software and Affected Versions yushine InnoShop versions prior to 0.8.2 Description A path traversal flaw exists in the Files Endpoint component. This issue occurs within the FileManagerController::destroyFiles function located in the innopacks/restapi/routes/panel-api.php...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HomeAutomation 3.3.2 - Open Redirect Detection

HomeAutomation 3.3.2 contains a redirect vulnerability caused by improper verification of the 'redirect' GET parameter in 'api.php', letting attackers redirect users to arbitrary websites, exploit requires user interaction with a crafted link. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Google Maps <7.11.18 - SQL Injection Detection

WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute...

Discuz! X2.5 - Path Disclosure Detection

Discuz! X2.5 api.php path disclosure vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Discuz! X2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Discuz! X2.5 - Path Disclosure Detection', 'description':...

SuperWebMailer 9.31.0.01799 - Cross-Site Scripting Detection

SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting XSS vulenrability via the component api.php. !/usr/bin/env python3 -- coding: utf-8 -- """SuperWebMailer v9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CVE-2026-14482

The CVE-2026-14482 entry covers the WordPress plugin “多说社会化评论框” (

CVE-2026-14482 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an...

UBUNTU-CVE-2026-58028

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php,...

CVE-2026-42562

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/id. The endpoint directly persists the admin attribute from user input, and the escalated accou...

CVE-2026-42562: Improper Privilege Management

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/id. The endpoint directly persists the admin attribute from user input, and the escalated accou...

CVE-2026-5324: Improper Neutralization of Input During Web Page Generation

The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when ...

CVE-2019-25342: Allocation of Resources Without Limits or Throttling

Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoint. Attackers can trigger 100% CPU load by sending multiple concurrent requests to the /api.php endpoint with crafted parameters...

CVE-2020-37012: Improper Neutralization of Special Elements used in an OS Command

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API...