CVE-2024-22198_Checker

CVE-2024-22198 - ejecución remota de código autenticado en Nginx-ui Descripción Esta herramienta está diseñada para comprobar de forma remota la versión de Nginx-ui y notificar si es vulnerable a CVE-2024-22198. Nginx-UI es una interfaz web para gestionar configuraciones de Nginx. Es vulnerable a...

CVE-2021-1675_CarbonBlack_HuntingQuery

Consulta de caza en CarbonBlack para CVE-2021-1675 PrintNightmare 1 Basado en la regla Sigma para detectar el código POC filemodname:c:\windows\system32\spool\drivers\x64\3\old\1\123 2 Basado en la regla Sigma para detectar el código POC...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Falta de autorización a través de handleRequest Descripción: El plugin RumbleTalk Live Group Chat para WordPress es vulnerable a acceso no autorizado de datos, modificación de datos y pérdida de datos debido a una falta de comprobación de...

CVE-2025-66683

CVE-2025-66683 A Cross-Site Request Forgery CSRF vulnerability exists in the administrator profile update functionality of CarRentalMS v2.0. The affected endpoint does not implement anti-CSRF protections, allowing an attacker to perform unauthorized profile modifications on behalf of an...

CVE-2023-36845-Juniper-Vulnerability

CVE-2023-36845 Este script proporciona una Prueba de Concepto PoC automatizada para CVE-2023-36845, una vulnerabilidad que afecta a Junos OS de Juniper Networks en dispositivos de las series EX y SRX. Explota el componente J-Web, permitiendo la modificación remota de la variable PHPRC y una posib...

CVE-2023-42820

CVE-2023-42820 CVE-2023-42820 Vulnerability Description JumpServer Password Reset Vulnerability USAGE V2 Update 1. Complete refactoring 2. Added default account and email when no account or email is received 3. Improved recognition and calculation of CAPTCHA 4. Automatically modify password 5...

yellow

| | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - solo añade azul Modificaciones binarias sencillas que activarán un canarytoken cuando se ejecute un binario. Ideal para colocar trampas en sistemas de producción contra atacantes. Actualmente hay...

CVE-2026-97337

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

CVE-2026-91078

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

EUVD-2026-91944

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion vulnerability

Unauthenticated Abandoned Cart Modification and Deletion vulnerability discovered by Mutantgun in WordPress Plugin MailChimp For WooCommerce versions 6.3...

CVE-2026-92437

The Mailchimp for WooCommerce WordPress plugin, in versions prior to 6.3 , is vulnerable to unauthorized data modification. The application fails to implement authentication , nonce , or ownership checks when processing customer abandoned-cart records identified via request-supplied data. This fl...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-97337

The Simple Membership plugin for WordPress is vulnerable to unauthorized data modification and sensitive information disclosure in versions up to and including 4.8.3 . The root cause is a missing authorization check (including no nonce, capability, or ownership verification) on the resend-activat...

EUVD-2026-91908

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

CVE-2026-97337: Missing Authorization

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

PT-2026-104561

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...