Exploit for CVE-2025-8570

CVE-2025-8570 BeyondCart Connector = 2.1.0 - Missing Confi...

CVE-2025-8570

The BeyondCart Connector plugin for WordPress (versions 1.4.2 through 2.1.0) is affected by Privilege Escalation due to improper JWT secret management and authorization in the determine_current_user filter. This allows unauthenticated attackers to craft valid JWTs and impersonate any user (includ...

WordPress plugin BeyondCart Connector has a vulnerability related to trust management issues.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A trust management issue...

Imperva API Security: Authentication Risk Report—Key Findings & Fixes

An in-depth analysis of common JSON Web Token JWT mistakes, basic auth, long-lived tokens, and quick, high-impact fixes to secure your APIs . Introduction APIs are the backbone of modern digital services—from mobile apps and e-commerce to banking and IoT. That scale and utility also make them pri...

PT-2025-37134

Name of the Vulnerable Software and Affected Versions BeyondCart Connector plugin for WordPress versions 1.4.2 through 2.1.0 Description The BeyondCart Connector plugin for WordPress is susceptible to privilege escalation due to improper JWT JSON Web Token secret management and authorization with...

ROS-20250905-04

A vulnerability in the radosgw daemon of the Ceph data storage system is related to insufficient authentication of the when processing JWT tokens. Exploitation of the vulnerability could allow an intruder acting remotely to bypass the authentication procedure...

CVE-2025-44017

"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT JSON Web Token...

File Information Disclosure

The vulnerability of the web manager responsible for managing files and directories in the File Browser is related to the disclosure of information through query strings. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the user account usi...

CVE-2025-44017

"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT JSON Web Token...

CVE-2025-44017

"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT JSON Web Token...

CVE-2025-44017

"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT JSON Web Token...

CVE-2025-44017

CVE-2025-44017 concerns the"Gunosy" App and involves insertion of sensitive information into sent data (CWE-201). The exposed data could include a JWT if a user visits a crafted URL, enabling token leakage via outbound communication. Concrete details from connected sources show affected platforms...

"Gunosy" App vulnerable to insertion of sensitive information into sent data

Overview "Gunosy" App provided by Gunosy Inc. contains the following vulnerability. Insertion of sensitive information into sent data CWE-201 - CVE-2025-44017 YUNAO ZHOU of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

JVN#47404248: "Gunosy" App vulnerable to insertion of sensitive information into sent data (CWE-201)

"Gunosy" App provided by Gunosy Inc. contains the following vulnerability. Insertion of sensitive information into sent data CWE-201 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 5.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Base Score 4.3 CVE-2025-44017 Impact If ...

Gunosy security vulnerabilities

Gunosy is a news and information application from the Japanese company Gunosy. Gunosy suffers from a security vulnerability that stems from the disclosure of sensitive information and could lead to the acquisition of a JWT token via a specially crafted URL...

PT-2025-35542

Name of the Vulnerable Software and Affected Versions: Gunosy affected versions not specified Description: The Gunosy App contains an issue where sensitive information may be included in its outbound communication. Accessing a crafted URL could allow an attacker to obtain the JSON Web Token JWT...

CVE-2025-30064

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

GHSA-5V66-M237-HWF7 Payload does not invalidate JWTs after log out

Payload uses JSON Web Tokens JWT for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date which is by default set to 2 hours, but can be changed. This issue has been fixed in version 3.44.0 of...

Insufficient Session Expiration

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JSON Web Tokens after user log out. An attacker can maintain unauthorised access by reusing a...

Insufficient Session Expiration

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Insufficient Session Expiration due to the reuse of user identifiers in the account creation process. An attacker can gain unauthorised access to a newly create...