WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...

CVE-2026-78149

The Smart Post WordPress plugin (versions 4.0.0 through 4.0.7 ) is vulnerable to unauthenticated disclosure of password-protected post content and its stored password. The root cause is an unauthenticated AJAX action (sp_handle_post_id) that returns a post's content and password without first ver...

CVE-2026-78150

The Smart Post WordPress plugin versions 4.0.0 through 4.0.7 are affected by an IDOR (Insecure Direct Object Reference) vulnerability in the post duplication functionality. The plugin does not verify the type, ownership, or status of the post being duplicated, allowing any user with contributor p...

CVE-2023-27163-POC

CVE-2023-27163 PoC SSRF для Request-Baskets CVE-2023-27163 на основе этого кода от entr0pie. PoC расширен для фаззинга содержимого другого веб-сервиса локального или любого другого и возврата содержимого найденных файлов. Использование root@kitploit: python3 CVE-2023-27163.py http://: -t http://:...

CVE-2019-3799

CVE-2019-3799 - Обход каталога в Spring-Cloud-Config-Server Spring Cloud Config, версии 2.1.x до 2.1.2, версии 2.0.x до 2.0.4 и версии 1.4.x до 1.4.6, а также более старые неподдерживаемые версии позволяют приложениям обслуживать произвольные файлы конфигурации через модуль...

CVE-2019-5418

CVE-2019-5418 - Rails에서의 파일 내용 노출 수정 : 이 CVE는 원격 코드 실행Remote Code Execution으로 이어질 수 있습니다. 자세한 정보: https://github.com/mpgn/Rails-doubletap-RCE Action View에 파일 내용 노출 취약점이 존재할 수 있습니다. 특수하게 조작된 accept 헤더와 render file: 호출을 함께 사용하면 대상 서버의 임의의 파일이 렌더링되어 파일 내용이 노출될 수 있습니다. 이 영향은 지정된 accept 형식 없이 파일 내용을...

WordPress Content Views plugin < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Content Views versions 4.5.1.2...

EUVD-2026-58625

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Non-Public Post Content Disclosure vulnerability

Author+ Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability

Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

CVE-2026-16966

Solace Extra WordPress plugin before 1.7.0 has a missing authorization and post-status check in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally ...

CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability

Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...

nextjs-CVE-2024-34351-_exploit

CVE-2024-34351 Эксплойт CVE-2024-34351 PoC Next.js подделка серверных запросов SSRF в серверных действиях · CVE-2024-34351 · База данных консультаций GitHub Исследование SSRF в приложениях NextJS Краткое описание PoC для полной эксплуатации SSRF в NextJS. Злоумышленник может получить любое...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-13172 Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...

CVE-2026-13172

Eventin (WP Event Solution) WordPress plugin versions before 4.1.22 fail to restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending, and private posts belonging to other users, including the pa...

WordPress Eventin plugin < 4.1.22 - Unauthenticated Unpublished Content Disclosure vulnerability

Unauthenticated Unpublished Content Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.22...

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...