3258 matches found
WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read
WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. id: CVE-2025-10897 info: nam...
TEN Framework - Arbitrary File Read & Write
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication. id: CVE-2026-85688 info: name: TEN Framework -...
News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion
The News & Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdpgetmorepost function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data. id: CVE-2023-5815...
CVE-2023-25202
CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a clickjacking attack (CVE-2026-18194)
Summary IBM App Connect Enterprise Designer authoring is vulnerable to a clickjacking attack. Vulnerability Details CVEID:CVE-2026-18194 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls. CWE:CWE-1021:...
CVE-2025-10897
CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...
CVE-2024-51818
CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-6440-Poc-Exploit
WC Designer Pro — Unauthenticated Arbitrary File Upload Security Research Proof of Concept A non-destructive proof of concept for an unauthenticated arbitrary file-upload vulnerability affecting the WC Designer Pro WordPress plugin. Table of Contents Vulnerability Overview Security Impact Affecte...
CVE-2025-6440
🧨 CVE-2025-6440 – WooCommerce Designer Pro Unrestricted File Upload Unauthenticated Arbitrary File Upload viawcdpsavecanvasdesignajax WooCommerce Designer Pro plugin – Remote Code Execution RCE 📖 Description The WooCommerce Designer Pro plugin for WordPress contains an unauthenticated arbitrary...
JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...
WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502
CVE-2025-14502 Vulnerability Analysis Report Vulnerability Overview Vulnerability Type : Local File Inclusion LFI Affected Versions : News and Blog Designer Bundle 1.1 and all earlier versions Severity : High Attack Complexity : Low no authentication required Vulnerability Principle Analysis 1...
CVE-2025-6440
CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Unauthenticated Arbitrary File Upload Description WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation i...
Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-68497
Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-68497 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbat...
Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs
Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...
Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-71497
Summary Vulnerability in jsoup.jar in IBM Integration Designer: CVE-2026-71497 Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a...
Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs
Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-19032 and CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...
Disclosures
Disclosures This repository contains my vulnerability reports which aren't under an NDA or restricted by VRP terms of service. Contents Fancy Product Designer Microsoft Xfinity...
CVE-2025-6440
CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...
