CVE-2026-114272

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an authorization bypass in the content viewing component. An authenticated user with role-scoped content view permissions can access data they are not authorized to view by sending a ViewSimpleContent request. This req...

CVE-2026-105971

The Car Dealer (Dealership) and Vehicle sales WordPress plugin, in versions up to and including 4.73 , is vulnerable to an unauthenticated content disclosure. The root cause is that the plugin's single-listing AJAX action (specifically cardealer_single_car_ajax) does not restrict access to publis...

gortex-PoC

Symlink Following in Indexer File-Walk → Out-of-Repo Content Disclosure via searchtext CVE status: requested, pending assignment. This finding is published as GHSA-6vhf-4wcm-2r83. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-gortex-PoC and this banner is replaced with the CVE link....

CVE-2019-5418

CVE-2019-5418 - File Content Disclosure on Rails EDIT : this CVE can lead to a Remote Code Execution, more info: https://github.com/mpgn/Rails-doubletap-RCE There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to rend...

CVE-2019-3799

CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the...

nextjs-CVE-2024-34351-_exploit

CVE-2024-34351 Exploit CVE-2024-34351 PoC Next.js Server-Side Request Forgery in Server Actions · CVE-2024-34351 · GitHub Advisory Database Digging for SSRF in NextJS apps Summary PoC for a full exploitation of NextJS SSRF. An attacker can get any website content from Next.js server using...

CVE-2023-27163-POC

CVE-2023-27163 Poc of SSRF for Request-Baskets CVE-2023-27163 based on this code from entr0pie. The PoC is expanded to fuzz the content of another web service local or otherwise and return the content of the files found. Usage python3 CVE-2023-27163.py http://: -t http://: -w...

CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

WordPress Quick Event Manager plugin 8.4.6-9.18 - Unauthenticated Private and Draft Content Disclosure vulnerability

Unauthenticated Private and Draft Content Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quick Event Manager versions 8.4.6-9.18...

CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

SUSE-SU-2026:4941-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme bsc1276223. - CVE-2026-17084: StringPrep...

CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

CVE-2026-114270

The GeoDirectory WordPress plugin in versions prior to 2.8.197 contains a vulnerability where it fails to honor post password protection when rendering a listing. This flaw allows unauthenticated users to access and disclose the content and custom fields of published listings that are intended to...

CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

WordPress GeoDirectory plugin < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure vulnerability

Unauthenticated Password-Protected Listing Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin GeoDirectory versions 2.8.197...

WordPress Recipe Card Blocks Lite plugin 2.6.4-3.6.3 - Unauthenticated Unpublished Post Content Disclosure vulnerability

Unauthenticated Unpublished Post Content Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor versions 2.6.4-3.6.3...

CVE-2026-107100

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to...

CVE-2026-111961 Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without...

WordPress Royal MCP plugin < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass vulnerability

Contributor+ Private and Draft Content Disclosure and publishposts Bypass vulnerability discovered by Usama Arshad in WordPress Plugin Royal MCP versions 1.5.10...

CVE-2026-111961

The Royal MCP WordPress plugin (versions before 1.5.10 ) is vulnerable to a broken access control issue. The plugin fails to perform an object-level permission check when duplicating a requested page, relying on a generic capability instead. This allows users with contributor-level access to read...