CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268

CVE-2026-78268 affects the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) in versions ≤ 1.2.0 . The vulnerability allows unauthenticated sensitive data exposure through the plugin's Chat Button, Phone Call, Telegram, and Email contact features, with no user interaction r...

react-server-cve-lab

Laboratorio di Sicurezza React Server Components CVE-2025-55183 e CVE-2025-55184 Un ambiente completo di test di sicurezza per le vulnerabilità CVE-2025-55183 Esposizione del codice sorgente e CVE-2025-55184 Denial of Service in React Server Components. ⚠️ Disclaimer SOLO PER SCOPI EDUCATIVI E DI...

HeartbleedAttack

Heartbleed-Angriff: Java-basierte Angriffsdemo Übersicht Dieses Repository enthält Heartbleed.java, einen benutzerdefinierten Java-basierten Exploit zur Demonstration der Heartbleed-Sicherheitslücke CVE-2014-0160. Er extrahiert vertrauliche Daten von einem verwundbaren Server IP: 192.168.1.132, a...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

CVE-2024-0368

CVE-2024-0368 Il plugin Hustle = 7.8.3 contiene credenziali dell'API HubSpot hardcoded in inc/providers/hubspot/hustle-hubspot-api.php Riepilogo della vulnerabilità...

CVE-2023-5070

CVE-2023-5070 Pulsanti di condivisione social media e icone di condivisione social = 2.8.5 - Esposizione di informazioni Descrizione: Il plugin Social Media Share Buttons & Social Sharing Icons per WordPress è vulnerabile all'esposizione di informazioni sensibili nelle versioni fino alla 2.8.5...

CVE-2023-47668

CVE-2023-47668 Restrict Content = 3.2.7 - Esposizione di informazioni tramite file di log legacy Descrizione: Il plugin Membership – Restrict Content per WordPress è vulnerabile all'esposizione di informazioni sensibili in tutte le versioni fino alla 3.2.7 inclusa tramite il file di log legacy. C...

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Nicht authentifizierte Offenlegung sensibler Informationen über Debug-Log Beschreibung Das EWWW Image Optimizer Plugin für WordPress ist in allen Versionen bis einschließlich 7.2.0 über die Funktion debuglog anfällig für die Offenlegung sensibler...

masq

Mascherata rinascimentale. Siediti al posto dell'agente. masq Siediti al posto dell'agente. Una CLI che parla MCP e OpenAI-compat come fa il modello, poi genera report stile linpeas. Risultati più remediation. Nessun payload di exploit. Nessuna decrittazione del CoT. | ---|--- Cosa| Recon live...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Esposizione Pubblica degli Indirizzi Email degli Utenti CVE-2025-59843 Ambito / Applicazione Interessata: FlagForge Web Application Endpoint API: /api/user/username Dettagli: L'endpoint restituisce gli indirizzi email degli utenti senza autenticazione. Qualsiasi...

azure-security-auditor

Azure Security Posture Auditor Uno strumento CLI leggero, in stile produzione, che controlla le configurazioni di sicurezza di Azure ed evidenzia le misconfigurazioni più comuni, rispecchiando ciò che Microsoft Defender for Cloud verifica internamente. Controlli...