94252 matches found
CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability
Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
CVE-2026-84936
The EmbedPress WordPress plugin (versions 4.6.0-4.6.3 ) is vulnerable to an improper access control flaw in its public review-loading action. This allows unauthenticated users to force the website to make repeated billable third-party API requests using the site's configured API key and create an...
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
EUVD-2026-71862
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
SUSE CVE-2026-55477
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code...
CVE-2026-52763
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...
CVE-2026-15550: Missing Authorization
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...
CVE-2026-84937: Improper Neutralization of Special Elements used in an SQL Command
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
PT-2026-86394
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...
PT-2026-86359
šØ CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...
CVE-2026-84221: Improper Neutralization of Special Elements used in an SQL Command
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-86192: Authorization Bypass Through User-Controlled Key
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
CVE-2026-84936: Improper Access Control
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
EUVD-2026-71798
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...
CVE-2026-52763
YesWiki , a PHP-based wiki system, is affected by a stored SQL injection in the recentchanges action (actions/recentchanges.php). The period argument supplied via the action syntax ({{recentchanges period="..."}}) bypasses a whitelist that only validates the $_GET form, flowing unvalidated into P...
CVE-2026-52763 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...
secureboot_objects v1.7.0-signed
Secure Boot Objects This repository is used to hold the secure boot objects recommended by Microsoft. For documentation visit our Wiki! Versioning This repository follows semantic versioning .., which is a versioning scheme that conveys meaning about the underlying changes. Version Components Maj...