36862 matches found
CVE-2025-3605
🚀 Guia de Exploração do CVE-2025-3605 🛡️ Resumo da Vulnerabilidade O plugin Frontend Login and Registration Blocks para WordPress versões = 1.0.7 é vulnerável a escalada de privilégios via tomada de conta. O problema ocorre porque o plugin não valida a identidade do usuário ao atualizar detalhes...
CVE-2025-49029
🚨 Plugin WordPress Custom Login And Signup Widget 🔥 Punteggio Base: 9.1 CRITICO ID CWE: CWE-94 – Controllo improprio della generazione di codice 'Code Injection' 🧠 Descrizione Il plugin consente agli amministratori di modificare il contenuto di sn.php tramite il campo Nome del mittente nella pagi...
zyxel-social-login-bypass-cve-2026-8508
CVE-2026-8508: Bypass do Portal Cativo da Zyxel via Identidade do Facebook Submetida por Navegador Confiável Este repositório reúne o relatório público, o script de verificação rápida e artefatos de suporte selecionados para CVE-2026-8508. O que é isso CVE-2026-8508 é uma falha de fronteira de...
Bludit-3-9-2-bb
Bludit-3-9-2-bb Bludit 3.9.2 - bypass bruteforce - CVE-2019-17240 Script molto semplice basato su CVE-2019-17240. POC originale e spiegazione: https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u...
CVE-2026-59808
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...
EUVD-2026-64266
AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...
CVE-2026-77002
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
CVE-2026-77000
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-18052
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...
CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...
CVE-2026-77002
The SmilePass Selfie Login WordPress plugin through version 1.0.2 lacks any server-side verification of the identity it is asked to authenticate. This allows unauthenticated users to log in as any registered account, including administrators , resulting in full compromise of confidentiality, inte...
CVE-2026-77000
The WP Social Media Login WordPress plugin (through 1.0.6 ) fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. The CVELIST entry identifies the specific flow as the Twitter login flow . An unauthenticated attacker can log in as a...
EUVD-2026-64225
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-77002 SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
EUVD-2026-64226
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...
EUVD-2026-64227
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...
CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...
CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...
EUVD-2026-64219
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...
CVE-2026-18052
CVE-2026-18052 affects the ManageWP Worker WordPress plugin in versions prior to 4.9.37 . The plugin's auto-login mechanism fails to bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attacker who obtains...