WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...

CVE-2026-78150

The Smart Post WordPress plugin versions 4.0.0 through 4.0.7 are affected by an IDOR (Insecure Direct Object Reference) vulnerability in the post duplication functionality. The plugin does not verify the type, ownership, or status of the post being duplicated, allowing any user with contributor p...

CVE-2026-78149

The Smart Post WordPress plugin (versions 4.0.0 through 4.0.7 ) is vulnerable to unauthenticated disclosure of password-protected post content and its stored password. The root cause is an unauthenticated AJAX action (sp_handle_post_id) that returns a post's content and password without first ver...

CVE-2023-27163-POC

CVE-2023-27163 PoC de SSRF pour Request-Baskets CVE-2023-27163 basé sur ce code de entr0pie. Le PoC est étendu pour fuzzer le contenu d'un autre service web local ou autre et retourner le contenu des fichiers trouvés. Usage root@kitploit: python3 CVE-2023-27163.py http://: -t http://: -w...

CVE-2019-3799

CVE-2019-3799 - Обход каталога в Spring-Cloud-Config-Server Spring Cloud Config, версии 2.1.x до 2.1.2, версии 2.0.x до 2.0.4 и версии 1.4.x до 1.4.6, а также более старые неподдерживаемые версии позволяют приложениям обслуживать произвольные файлы конфигурации через модуль...

CVE-2019-5418

CVE-2019-5418 - كشف محتوى الملفات في Rails تعديل : يمكن أن تؤدي هذه الثغرة CVE إلى تنفيذ كود عن بُعد، مزيد من المعلومات: https://github.com/mpgn/Rails-doubletap-RCE توجد ثغرة محتملة لكشف محتوى الملفات في Action View. يمكن أن تتسبب رؤوس accept المصممة بعناية مع استدعاءات render file: في عرض ملفات...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

EUVD-2026-58625

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Non-Public Post Content Disclosure vulnerability

Author+ Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability

Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

CVE-2026-16966

Solace Extra WordPress plugin before 1.7.0 has a missing authorization and post-status check in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally ...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability

Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...

nextjs-CVE-2024-34351-_exploit

استغلال CVE-2024-34351 PoC لـ CVE-2024-34351 ثغرة تزوير الطلبات من جانب الخادم في Next.js ضمن Server Actions · CVE-2024-34351 · قاعدة بيانات GitHub الاستشارية التنقيب عن SSRF في تطبيقات NextJS الملخص PoC لاستغلال كامل لثغرة SSRF في NextJS. يمكن للمهاجم الحصول على محتوى أي موقع ويب من خادم Next.js...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-13172 Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...

CVE-2026-13172

Eventin (WP Event Solution) WordPress plugin versions before 4.1.22 fail to restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending, and private posts belonging to other users, including the pa...

WordPress Eventin plugin < 4.1.22 - Unauthenticated Unpublished Content Disclosure vulnerability

Unauthenticated Unpublished Content Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.22...

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...