3918 matches found
CVE-2026-19956 gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
CVE-2026-19956: Server-Side Request Forgery (SSRF)
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
PT-2026-73171
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch pagination url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
EUVD-2026-58810
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...
Replay Attack
Overview Affected versions of this package are vulnerable to Replay Attack through the getUserByOIDCToken process in FacebookProvider.php. An attacker can impersonate a victim account by replaying a captured, valid Facebook OIDC idtoken to userFromToken without providing a matching session nonce...
CVE-2026-73683
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...
CVE-2026-73683
CVE-2026-73683 affects Laravel Socialite’s Facebook provider. The flaw allows unauthenticated attackers to replay captured OIDC id_tokens via a missing nonce validation in FacebookProvider.php’s getUserByOIDCToken(), so a valid, unexpired id_token for the same Facebook App ID can be submitted to ...
CVE-2026-73683 Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...
CVE-2026-73683: Authentication Bypass by Capture-replay
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...
Malicious code in shadowx-fca (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27 The package advertises a Facebook Chat API FCA client. Its default-exported login function accepts email, password, and an optional 2FA secret and, v...
MAL-2026-13457 Malicious code in shadowx-fca (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27 The package advertises a Facebook Chat API FCA client. Its default-exported login function accepts email, password, and an optional 2FA secret and, v...
CVE-2026-66707
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66705
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
CVE-2026-66707 WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66707
CVE-2026-66707 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Facebook for WooCommerce up to version 3.7.5. The CVE is documented across multiple sources (NVD, CVE List, EUVD, Patchstack). The vulnerability affects the plugin’s handling of input that...
EUVD-2026-53910
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66707 WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66707
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...