EUVD-2026-49692

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-14490: Improper Limitation of a Pathname to a Restricted Directory

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-15012: Exposure of Sensitive Information to an Unauthorized Actor

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

PT-2026-65389

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

PT-2026-65396

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle restore step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability

Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.8...

MAL-2026-6702 Malicious code in vue-demi-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bf683b6e8715fecd451a06da256d90048054cbe463da64e43c1a8db4226b661 vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall and postinstall lifecycle...

Malicious code in vue-demi-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bf683b6e8715fecd451a06da256d90048054cbe463da64e43c1a8db4226b661 vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall and postinstall lifecycle...

USN-4635-1 krb5 vulnerability

Demi Obenour discovered that Kerberos incorrectly handled certain ASN.1. An attacker could possibly use this issue to cause a denial of service...

Demi Lovato: Path to Fame - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Demi Lovato: Path to Fame published at the 'play' market has multiple vulnerabilities...