ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

CVE-2026-103427 Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-103427

The Simple Membership plugin for WordPress (versions up to and including 4.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'country' parameter. This allows authenticated attackers with subscriber-level access ...

EUVD-2026-96206

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

private-membership

Private Set Membership PSM Problem Statement Private Set Membership PSM is a cryptographic protocol that allows clients to privately query whether the client's identifier is a member of a set of identifiers held by a server in a privacy-preserving manner. At a high level, PSM provides the followi...

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. id: CVE-2022-1724 info: name: WordPress Simple Membership 4.1.1 - Cross-Site Scripting author:...

User Registration & Membership WordPress plugin - Open Redirect

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. id: CVE-2026-6203 info: name: User...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

WordPress Simple Membership plugin <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Simple Membership versions = 4.8.4...

lxd-group-privesc-report

LXD Root 기본 lxd 그룹 멤버십과 Ubuntu의 lxd-installer 패키지를 통해 root 로 로컬 권한 상승 데모는 AWS EC2 Ubuntu Server 26.04에서 실행됩니다. 버그는 Ubuntu Server 26.04의 기본 설치가 기본 사용자에게 묵시적으로 lxd 그룹 멤버십을 부여한다는 점입니다. 이 그룹은 LXD의 신뢰 모델에 따라 비밀번호 없는 root와 동등하며, 무해한 "컨테이너 관리" 기능으로 제시됩니다. 게다가 권한이 없는 사용자는 추가 권한 없이도 LXD를 직접 설치 및 설정할 수 있으므...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

CVE-2026-62040

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...

EUVD-2026-95729

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...

CVE-2026-62040

The Restrict User Access – Membership Plugin with Force (WordPress plugin) is vulnerable to a Broken Access Control issue in versions up to and including 2.8.1 . The root cause is a Missing Authorization flaw that allows for the exploitation of incorrectly configured access control security level...

CVE-2026-62040 WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...

WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Salúa Es-sair in WordPress Plugin Restrict User Access – Membership Plugin with Force versions = 2.8.1...