58617 matches found
EUVD-2026-23188
The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2026-3614 AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wpajaxacymailingrouter AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2026-41015
creationtimestamp| type| source ---|---|--- 2026-04-16 05:18:09+00:00| seen| Telegram/RpCSTqHfWBqrKG53EyhvOrMVfWJfX1b8PG9fT94i9MHNW6c...
EUVD-2026-23125
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'processcheckout' function not properly enforcing...
CVE-2026-40192
creationtimestamp| type| source ---|---|--- 2026-04-16 00:48:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjl6rxxkxp2o 2026-04-17 17:30:59+00:00| published-proof-of-concept| Telegram/TfvL4UdHtH3ZuzBSEbo8ShneR8BWZRWY3OJLSl5lBMznWjk 2026-04-22 13:26:30+00:00| seen|...
WordPress Riaxe Product Customizer plugin <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter vulnerability
Unauthenticated Arbitrary User Deletion via 'userid' Parameter vulnerability discovered by Kai Aizen in WordPress Plugin Riaxe Product Customizer versions = 2.1.2...
CVE-2026-4880
The Barcode Scanner +Mobile App – Inventory manager, Order fulfillment system, POS Point of Sale plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied...
PT-2026-33318
Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.1.22 Description An Insecure Direct Object Reference IDOR exists due to missing authorization and ownership validation on a user...
WordPress plugin Fluent Forms 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/viewaccount.php?empid=...
CVE-2026-37346
SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id= as indicated by multiple sources. The root cause is improper handling of the emp_id parameter in the SQL query, enabling injection. The connected documents do...
PT-2026-33268
Name of the Vulnerable Software and Affected Versions Accessibility Suite by Ability, Inc versions prior to 4.21 Description The Accessibility Suite by Ability, Inc plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to perform SQL Injectio...
PT-2026-33372
CVE-2024-58343 Vision Helpdesk before 5.7.0 patched in 5.6.10 allows attackers to read user profiles via modified serialized cookie data to vis client id. https://t.co/8Cf7DKLrcr...
D-Link DI-8003 Buffer Overflow Vulnerability (CNVD-2026-17634)
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability that originates from improper validation of the id parameter in the /thdmember.asp endpoint, which can be exploited by an attacker to cause a denial of service...
The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary code.
The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system is related to the failure to eliminate special elements “|” when processing the jid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending...
Fedora: Security Advisory (FEDORA-2026-2af3865ebf)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-WG36-WVJ6-R67P
creationtimestamp| type| source ---|---|--- 2026-04-15 23:27:35+00:00| seen| Telegram/ajbOyvFAewWZ2L70l5GRQuj2wRnDYaN4zfpEHfJh7NMuY...
CVE-2026-4880 Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
The Barcode Scanner +Mobile App – Inventory manager, Order fulfillment system, POS Point of Sale plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied...