aws-key-disabler

AWS Lambda - Desactivador de Claves de Acceso IAM El desactivador de claves de AWS es una función Lambda que desactiva las claves de acceso de usuarios IAM de AWS después de un tiempo determinado para reducir el riesgo asociado a claves de acceso antiguas. Arquitectura de AWS Lambda Salida de...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

cve-2023-6931-pipa

CVE-2023-6931 — Xiaomi Pad 6（pipa）提权与关 SELinux 最终在设备上使用的那一版 exploit，单独整理在此目录。 目标 设备 Xiaomi Pad 6 / pipa / SM8250 系统 HyperOS OS2.0.20.0.UMZCNXM 内核 4.19.157-perf-g240e1d0a5f52 起点 adb shell（shell 域） 结果 一次性 uid0 + 全局 SELinux permissive（重启失效） 利用链 见 exploit.c 文件头，摘要如下。 1 perf group readsize overflow - ...

CVE-2025-67315

CSRF para Desactivar Cualquier Empleado Resumen La funcionalidad Gestionar Empleados es vulnerable a Cross-Site Request Forgery CSRF. Un atacante puede engañar a un administrador con sesión iniciada para que envíe una solicitud falsificada que inactiva a un empleado p. ej., inid=1 sin el...

CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Abstract: A High-Severity Cross-Site Request Forgery CSRF vulnerability CVE-2026-13156 was discovered in the official MailerSend SMTP Integration plugin for WordPress 1.0.8. The configuration eradication handler...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Controles de acceso inadecuados en las llamadas AJAX Suscriptor+ Descripción: Algunas de las llamadas AJAX del plugin no comprueban correctamente las capacidades y los tokens CSRF, lo que provoca problemas como la lectura arbitraria de...

CVE-2026-7622

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-7622 ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-7622

The ThumbPress plugin for WordPress, in versions up to and including 6.2.1 , is vulnerable to unauthorized access. The root cause is a lack of capability checks and nonce verification within the send_deactivation_survey() function, which is registered via the wp_ajax_pl-plugin-deactivation AJAX a...

CVE-2026-7622: Missing Authorization

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin (versions 3.0.0-3.1.8 ) is vulnerable to unauthenticated popup deactivation. The flaw exists because the plugin fails to perform proper authorization checks on the AJAX action used to deactivate its Popup Builder popups. Instead, the action relies ...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

WordPress Master Addons for Elementor plugin 3.0.0-3.1.8 - Unauthenticated Popup Deactivation vulnerability

Unauthenticated Popup Deactivation vulnerability discovered by JunHee CHO in WordPress Plugin Master Addons for Elementor versions 3.0.0-3.1.8...

EUVD-2026-80892

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-81921

Concrete CMS versions 8.5.3 through 9.5.2 are affected by an OAuth 2.0 refresh-token grant flaw. The unmodified upstream League grant issued new access tokens from a valid refresh token without re-checking the associated account's active status . Consequently, a user who obtained a refresh token ...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

PT-2026-92392

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...