90193 matches found
ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...
WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization
WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...
CVE-2025-57298
Stored XSS via Unsafe Markdown Rendering in Kotaemon Summary Kotaemon is an open-source RAG Retrieval-Augmented Generation based document QA system that provides a web interface for querying uploaded documents such as PDF, Word, and Excel files. A stored cross-site scripting XSS vulnerability...
CVE-2026-73292
CVE-2026-73292 – CSRF Password Change in Semaphore UI For educational and responsible disclosure purposes only. This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21. Vulnerability The password change endpoint of Semaphore UI does not implement...
CVE-2020-1938
This repository does not have a README...
CVE-2026-44578
CVE-2026-44578 — Next.js WebSocket Upgrade Handler SSRF Lab Security Academy CERT Project vulnerability reproduction lab environment for mentor demos Overview...
CVE-2019-3396
Este repositorio no tiene un README...
CVE-2025-48384-p
This repository does not have a README...
CVE-2025-67303
This repository does not have a README...
cve-2019-48814
This repository does not have a README...
CVE-2026-12956 Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...
EUVD-2026-74565
The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...
CVE-2026-12956
The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...
CVE-2024-3400
This repository does not have a README...
download
This repository does not have a README...
CVE-2022-40916
This repository does not have a README...
CVE-2026-87534
A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...
CVE-2026-87434
A flaw was found in Chromium, affecting Google Chrome. A remote attacker, having compromised the renderer process, could exploit missing authorization in Cross-Origin Resource Sharing CORS to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page,...
CVE-2026-87429
A flaw was found in the ServiceWorker component of Chromium. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...