CVE-2026-77752

Temporary Login Without Password is a WordPress plugin for managing temporary user access. Versions 1.5 through 1.9.8 fail to verify that a user requesting a temporary login already holds network super admin rights before granting those rights to the new or existing account. In a multisite networ...

CVE-2026-77705

The Amelia (Booking for Appointments and Events Calendar) WordPress plugin before 2.4.10 contains an authorization flaw in its customer/employee record editing feature. The plugin does not verify whether the user editing a record is entitled to modify the linked WordPress account. Users with Amel...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution 未授权扫描器 针对影响 Slider Revolution WordPress 插件（版本 6.7.0）的 CVE-2024-34444 的专业批量扫描器 Banner 🎯 描述 CVE-2024-34444 是 Slider Revolution WordPress 插件（版本 6.7.0）中的一个缺失授权 漏洞。该扫描器通过 REST API 端点 /wp-json/revslider/v1/slider/save 自动检测并利用易受攻击的安装。 技术细节 CVE ID : CVE-2024-34444 CVSS ...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927 脆弱性の再現と修正。 root@kitploit: git clone [email protected]/Bongni/CVE-2025-29927.git cd CVE-2025-29927 vulnerable/ ディレクトリには、攻撃に対して脆弱なバージョンのアプリケーションがあります。fixed/ ディレクトリには、脆弱性を修正した最小バージョンにアップグレードされたアプリケーションがあります。 ⚠️ 重要:...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - 订阅者+ 任意选项更新 描述 Content Mask WordPress 插件在 1.8.4.1 之前的版本中，多个 AJAX 操作缺少授权和 CSRF 检查，同时也没有验证要更新的选项以确保其属于该插件。因此，任何已认证用户（例如订阅者）都可以修改任意博客选项。 使用方法 漏洞利用 root@kitploit: $ python3 CVE-2022-1203.py -u http://wordpress.lan -un user -p useruser1 The plugin version is below...

CVE-2025-65669

CVE-2025-65669 classroomio 0.1.13 において、学生アカウントが Explore ページからコースを削除できる問題が発見されました。これは認可や認証のチェックを一切行わず、管理者のみが削除できるという想定を回避するものです。発見者: Rivek Raj Tamang RivuDon、シッキム州、インド 影響を受ける製品: ClassroomIO 影響を受けるバージョン: 0.1.13 発見者: Rivek Raj Tamang RivuDon、シッキム州、インド 脆弱性の詳細 不適切なアクセス制御 概要 ClassroomIO 0.1.13...

CVE-2025-34171

CVE-2025-34171：CasaOS 中未经身份验证的文件与调试数据暴露 漏洞概述 字段| 值 ---|--- CVE 编号| CVE-2025-34171 影响版本| CasaOS ≤ 0.4.15 修复版本| 无可用补丁 严重性| 中危 CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-862：缺少授权，CWE-497：向未经授权的控制范围暴露敏感系统信息 执行摘要 CasaOS 0.4.15 及更早版本包含多个未经身份验证的 API...

EUVD-2026-76743

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

EUVD-2026-76746

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

PT-2026-90637

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

cve-2025-29927

CVE-2025-29927 1. /api/flag にアクセスする 2. ヘッダーとして x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware を追加する 3. レスポンスを確認する...

cve-2026-29204-whmcs-clientarea-addonid

CVE-2026-29204 — Guardia de complemento del área de cliente de WHMCS Notas no oficiales de la comunidad para CVE-2026-29204: en clientarea.php?action=productdetails, un cliente autenticado puede proporcionar un addonId externo con modop=custom y acceder al contexto del módulo que no pertenece a l...

DEBIAN-CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90454

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90454

A read-only deployment mode for a product with a bundled packet-analysis component (per the CISA ICS-CERT advisory reference) uses a pattern-based deny list to block write-capable routes, but the pattern omits routes that modify tags on stored session records . Since the proxy otherwise permits t...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90450

CVE-2026-90450 is a fail-open authorization flaw in which the application's role-authorization lookup grants access by default when a request handler is not present in its table of role requirements. Consequently, any request handler not explicitly registered in the table is reachable by any auth...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...