CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-88844

CVE-2026-88844 affects the MasterStudy LMS WordPress plugin (versions 3.6.2 through 3.7.49 ), fixed in version 3.7.50 . The root cause is an IDOR (Insecure Direct Object Reference): the plugin does not verify that the requesting user owns a course before returning its enrolled-student data. As a ...

CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure vulnerability

Bookit Staff+ Appointment PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin BookIt versions 2.6.0.5...

CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

EUVD-2026-82678

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-89008

CVE-2026-89008 affects the Bookit — Booking & Appointment Calendar WordPress plugin in versions before 2.6.0.5 . A missing authorization check on an appointment-retrieval action allows authenticated users holding a low-privilege Bookit-specific role (referred to as Staff+ in Patchstack) to read o...

WordPress MasterStudy LMS WordPress Plugin plugin 3.6.2-3.7.49 - Instructor+ Student PII Disclosure vulnerability

Instructor+ Student PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.6.2-3.7.49...

CVE-2026-84903

King Addons for Elementor is a WordPress plugin that, in versions before 51.1.81 , fails to perform any capability, post-status, or password check before rendering the content of a user-supplied post via the kng_maintenance_page shortcode. This allows any user with Contributor-level access or abo...

CVE-2026-84903 King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

EUVD-2026-82662

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

WordPress King Addons for Elementor plugin < 51.1.81 - Contributor+ Private Post Content Disclosure vulnerability

Contributor+ Private Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.81...

CVE-2026-84903 King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

MoxaPass

Este es un exploit de ejemplo para CVE-2016-9361. Recupera la cadena de comunidad SNMP y la contraseña 'admin' para muchos tipos de dispositivos Moxa. Utiliza el protocolo de gestión propietario UDP/4800 de Moxa. El protocolo carece de seguridad, y usar el código de función 'unlock' no requiere...

dlsw_exploit

DLSW Exploit Vulnerabilidad de divulgación de información en Cisco DLSw Hay un error en la implementación de DLSw de Cisco que afecta a los trenes de versiones 12.x y 15.x y que permite a un atacante remoto no autenticado recuperar el contenido parcial de los paquetes que atraviesan un router Cis...

optionsbleed

optionsbleed Esto es un código de prueba de concepto para comprobar el bug Optionsbleed en Apache httpd CVE-2017-9798. Por favor, considera usar la herramienta Snallygaster en su lugar; incluye una comprobación para optionsbleed: root@kitploit: snallygaster -t optionsbleed host uso root@kitploit:...

wordpress-exploits

wordpress-exploits Exploits aleatorios de WordPress pueden o no funcionar. CVE-2019-19985 Información root@kitploit: Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String:...

rosettaflash

Rosetta Flash CVE-2014-4671 Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restrict the SW...

ninja-forms-brute

Ninja Forms 3.6.8 - Divulgación no autenticada de direcciones de correo electrónico Descripción El plugin no elimina los archivos temporales creados al exportar los envíos, lo que podría permitir a atacantes no autenticados descargarlos y obtener información sensible, como la dirección de correo...