CVE-2026-17020

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclos...

PT-2026-69376

Name of the Vulnerable Software and Affected Versions Contact Form to Any API versions prior to 3.0.7 Description The plugin fails to use random filenames when copying files uploaded via contact forms into a publicly accessible directory. This allows unauthenticated attackers to enumerate and...

CVE-2026-12624: Incorrect Authorization

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

CVE-2026-72588: Observable Response Discrepancy

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

CVE-2026-18946: Exposure of Sensitive Information to an Unauthorized Actor

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users...

PT-2026-69341

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 9.7 Description An issue exists where the plugin fails to verify if an authenticated employee provider is associated with the customer record being accessed. This allows any user...

PT-2026-69472

Name of the Vulnerable Software and Affected Versions bluewave-labs/Checkmate versions prior to 2.1.1 Description An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint...

Hacked-Machines

HTB Writeups A collection of Hack The Box machines, solve...

CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

EUVD-2026-54574

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

pentest-metasploitable

Pentest Metasploitable 2 Automated reconnaissance, enumeratio...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the user creation wizard endpoint. An attacker can determine if an email address is associated with an existing user by sending requests to this endpoint without having permission to view user information...

EUVD-2026-54231

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

user-scanner v1.4.3.1

User Scanner A powerful 2-in-1 OSINT suite engineered for deep Email and Username Intelligence. With 380+ total scan vectors —including 155+ email-integrated sites and 225+ username platforms —you can map digital footprints, analyze target behavior, uncover interests, full metadata of usernames a...

post-exploitation-enumeration

Metasploitable2 – Post-Exploitation Enumeration Manual & Auto...

CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...

CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...

CVE-2025-13736: Observable Discrepancy

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...

Mail contact autocomplete bypasses administrator-configured user enumeration restrictions

None...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...