hdwebmobile-photo-video-reviews

HDWebmobile 写真・動画レビュー 顧客が商品レビューに写真や短い動画を添付できるWooCommerceプラグインで、商品ページのレビュー一覧に直接表示されます。 WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ 初回提出待ち 必要環境: WordPress 6.9+、WooCommerce、PHP 7.4+ ライセンス: GPLv2 以降 このプラグインが存在する理由 競合する「Customer Reviews for...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker 任意ショートコード実行 検証ラボ CVE-2026-89274 を再現・検証するためのセキュリティリサーチ資料: WP Recipe Maker 自身が所有するシステム、または明示的にテストを許可されたシステムでのみ使用すること。 この PoC は、ラボで登録されたマーカーショートコードを含む評価コメントを 1 件投稿する。 破壊的なショートコードは使用せず、ディスクへの書き込みも行わない。 判定 ステータス: 提供されたラボで実証済み。 WP Recipe Maker 10.8.1 WordPress...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - 未認証の任意ファイルアップロード ⚠️ 免責事項 このツールは教育およびセキュリティ研究目的のみで提供されています。 コンピュータシステムへの不正アクセスは違法です。このツールは、所有しているシステム、 または明示的なテスト許可を得たシステムでのみ使用してください。 作者は、このソフトウェアの誤用または損害について一切の責任を負いません。 📋 説明 CVE-2026-3844 は、WordPress 用 Breeze Cache プラグイン（バージョン ≤...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense お知らせ これは Sijia Zhanghttps://github.com/sijiahi と Bowen Zhouhttps://github.com/KonjakZhou によるプロジェクトです。 前提条件: 1 攻撃の再現: - http://localhost/wp-admin/ で Wordpress5.0 を設定・インストールします。 - 管理者として Wordpress にログインし、少なくとも1つの記事を投稿します。 -...

CVE-2026-103288

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103289

The Ghost content management system, specifically versions 5.9.0 before 6.44.1 , is vulnerable to an authorization bypass within its comments feature . An input validation issue allows authenticated members to access and view restricted comment data for which they lack proper authorization. No sp...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103288

The open-source publishing platform Ghost contains an input validation flaw within its comment like feature in versions 5.9.0 before 6.44.1 . This vulnerability allows an authenticated member to bypass authorization controls to delete comment likes or dislikes belonging to other users. Successful...

EUVD-2026-90681

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103274

Ghost versions 5.3.0 before 6.58.0 are vulnerable to an unauthenticated comment read vulnerability. The application fails to properly enforce access controls on comments when the site is in private mode , allowing unauthenticated visitors to read restricted comments and bypass intended privacy se...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...