EUVD-2026-114649

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

EUVD-2026-114656

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...

CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

CVE-2026-103898

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...

CVE-2026-103898 Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...

CVE-2026-103898

The Wp Social Login and Register Social Counter plugin for WordPress (versions up to and including 3.2.2 ) is vulnerable to an Authentication Bypass . The root cause lies in the social login REST callback at /wp-json/wslu-social-login/type/{provider}/, which uses permission_callback =&gt; __retur...

CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 3.8.2 . The vulnerability exists in the uo_login_action() function due to a parser-differential flaw involving the email parameter. While the plugin's account-verificat...

CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

davscan

DAVScan DAVScan is a quick and lightweight webdav scanner designed to discover hidden files and folders on DAV enabled webservers. The scanner works by taking advantage of overly privileged/misconfigured WebDAV servers or servers vulnerable to various disclosure or authentication bypass...

TrueConf Server Authentication Bypass

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access under an arbitrary username without a password...

OLIMPOX Authentication Bypass Info Disclosure

The vulnerability of the software for the training and control system “OLIMPOX” is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information and modify data within...

CRM Platform Authentication Bypass

The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...

Doctor Around Telemedicine Premium Authentication Bypass Info Disclosure

The vulnerability of the “Doctor Around. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

Doctor Near Telemedicine Premium Authentication Bypass

The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

QAFA Firmware Authentication Bypass

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

Enlogic SCADA System ENTTEK Authentication Bypass

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...

pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection

IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. id: CVE-2019-4716 info: name: IBM Planning Analytics - Authentication Bypass & Remote...