n-days

n-days A collection of POCs & writeups for iOS vulnerabilities either discovered by me, binary diffed from In-The-Wild updates or just cool non-public bugs. CVE| Patched In| Link| Reported by me| Exploited ITW| Description ---|---|---|---|---|--- CVE-2021-1757| iOS 14.4| poc - info| ✖️| ✖️| Kernel...

CVE-2026-113492

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

EUVD-2026-109214

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public draft, pending and private listings by supplying their ID...

CVE-2026-113490

The GeoDirectory WordPress plugin versions before 2.8.194 is vulnerable to an information disclosure flaw. The application fails to perform status or ownership checks when rendering a listing's map-popup via a single-item REST route . This allows unauthenticated users to access the title , permal...

CVE-2026-113492

The GeoDirectory WordPress plugin (versions prior to 2.8.194 ) is vulnerable to unauthorized information disclosure. An unauthenticated attacker can access the content of non-public listings (such as draft , pending , and private entries) by providing specific listing IDs to one of the plugin's u...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

CVE-2026-109934 Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protecte...

CVE-2026-109934

The Otter Blocks WordPress plugin (versions 3.1.1-3.2.7 ) is vulnerable to an unauthenticated non-public content disclosure via a REST API endpoint. The root cause is the plugin's failure to correctly determine if a post is publicly readable, as it incorrectly treats any post with a

WordPress Otter Blocks plugin 3.1.1-3.2.7 - Unauthenticated Non-Public Content Disclosure vulnerability

Unauthenticated Non-Public Content Disclosure vulnerability discovered by whp-wessel in WordPress Plugin Otter - Gutenberg Block versions 3.1.1-3.2.7...

CVE-2026-79633

A vulnerability in Apache Answer (affecting versions through 2.0.2 ) allows authenticated users to perform unauthorized actions on non-public content due to missing authorization checks . This flaw could enable users to mutate data they are not permitted to access. Users are recommended to upgrad...

CVE-2026-79633 Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

CVE-2026-74923 Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

WordPress Document Gallery plugin <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure vulnerability

Unauthenticated Non-Public Attachment Disclosure vulnerability discovered by a0yark in WordPress Plugin Document Gallery versions = 5.1.1...

CVE-2026-85568

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

CVE-2026-85568 Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

EUVD-2026-91938

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

CVE-2026-85568

The Unlimited Elements for Elementor WordPress plugin, in versions before 2.0.21 , is vulnerable to SQL injection because it fails to correctly handle a search value before rewriting an already prepared SQL statement. This flaw allows unauthenticated users to perform SQL injection attacks and ret...

CVE-2026-85568: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

PT-2026-104524

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description An issue exists where search values are not correctly handled before rewriting a prepared SQL statement. This allows unauthenticated users to perform SQL...