CVE-2025-12721

g-FFL Cockpit 'returntrue', making it completely accessible to any unauthenticated visitor. Located in class-sync-endpoint.php: 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', //...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Description CVE-2023-5359 is a cleartext storage vulnerability affecting the WordPress plugin W3 Total Cache in versions ≤ 2.7.5. This vulnerability allows remote attackers to access sensitive credentials stored in unencrypted PHP fil...

CVE-2025-70829

CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...

djangohunter

Djangohunter Tool designed to help identify incorrectly configured Django applications that are exposing sensitive information. https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en Usage Usage:...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

learning-management-system

learning-management-system Masteriyo - LMS for WordPress = 1.6.7 - Sensitive Information Exposure Plugin Info Software Type Plugin Software Slug learning-management-system view on wordpress.org Patched? Yes Remediation Update to version 1.6.8, or a newer patched version Affected Version 1.6.8...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – AI Chatbot for WordPress = 2.5.1 - Unauthenticated Information Exposure The MxChat Basic plugin does not verify session ownership in the mxchatfetchconversationhistory AJAX endpoint, allowing unauthenticated users to access other users' conversation history and IP...

CVE-2023-47668

CVE-2023-47668 Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin Example of the result Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful. 2024-12-24 20:47:19 -...

CVE-2025-44823

Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo CVE ID: CVE-2025-44823 Date: 2025-04-02 Authors: Alex Tisdale, Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

CVE-2023-5070

CVE-2023-5070 Social Media Share Buttons & Social Sharing Icons = 2.8.5 - Information Exposure Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsisaveexport...

CVE-2024-1208-and-CVE-2024-1210

CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API in LearnDash. Unauthenticated visitors can browse the quizzes and quiz questions without being enrolled in a connected course. Vulnerability: CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API CVSS: 5.3...

keepass_poc

CVE-2022-0725 POC for KeePass CVE-2022-0725 Steps to Reproduce: Step 1: Run "journalctl -f" in a terminal window. Step 2: Double click a password in KeePass. Step 3: Wait for the clear timeout to trigger. Actual results: See your plain text password logged in the terminal window Expected results:...

CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 and later versions have a broken access control issue that allows users with knowledge of resource UUIDs to read or add comments annotations on resources they are not authorized to access. UUIDs can be exposed in various parts of the...

CVE-2018-16987

CVE-2018-16987 This is a cleartext storage of sensitive information & sensitive information exposure vulnerability I found in Squash TM during a penetration test. SquashTM Squash TM is a web interface used to manage test cases. Link to the project Description Squash TM through at least 1.18.0...

CVE-2024-1209

CVE-2024-1209 Sensitive Information Exposure via assignments in LearnDash. Unauthenticated visitors can browse and download uploaded assignments. Vulnerability: CVE-2024-1209 Sensitive Information Exposure via assignments CVSS: 5.3 Medium Software: LearnDash sfwd-lms Affected versions: = 4.10.1...

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

KeyCloak - Information Exposure

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

Razvan Stanga Varnish/Nginx Proxy Caching = 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests. id: CVE-2025-62126 info: name:...