BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects от BetterLinks - 2.0.0 – 2.0.3 - Подписчик + Произвольная установка плагинов Описание Отсутствие проверок прав и недостаточная проверка nonce в AJAX-действии плагина позволили аутентифицированным пользователям устанавливать произвольные плагины на уязвимых...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF к произвольной перезаписи файлов в плагине Optimole для WordPress Краткое описание Уязвимость типа Cross-Site Request Forgery CSRF в плагине Optimole для WordPress версии = 4.2.5 позволяет неаутентифицированным злоумышленникам незаметно перезаписывать существующие ресурсы...

EUVD-2026-68366

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Неаутентифицированная произвольная загрузка файлов Описание : Плагин User Registration Advanced Fields для WordPress версии до 1.6.20 включительно уязвим к неаутентифицированной произвольной загрузке файлов через AJAX-действие...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

HT Mega < 3.0.7 - Sensitive Information Disclosure

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation

WordPress Contact Form 7 before version 2.3.4 allows unauthenticated users to use the wpcf7rgetnonce AJAX action to retrieve a valid nonce for any WordPress action/function. id: CVE-2021-24278 info: name: WordPress Contact Form 7 2.3.4 - Arbitrary Nonce Generation author: 2rs3c severity: high...

CVE-2026-0740-mass

CVE-2026-0740 — 大量ターゲットエクスプロイトエンジン 作成者: 0xNuts 貢献者: Cursor リポジトリ: https://github.com/ExDev994/CVE-2026-0740-mass CVE-2026-0740 のPoC: Ninja Forms File Uploads = 3.3.26 — 未認証の任意ファイルアップロード。これは RCE につながる可能性があります。 脆弱性は当初 Sélim Lanouar @whattheslime によって発見されました。大量ターゲットのPoCエンジンは 0xNuts によって開発され、Cursor...

CVE-2026-14894

CVE-2026-14894 — Super Forms 인증되지 않은 파일 업로드 RCE Nonce 유출 → datauristring 업로드 → 코드 실행 개요 CVE-2026-14894 는 Super Forms – Drag & Drop Form Builder 워드프레스 플러그인WebRehab 제작 버전 ≤ 6.3.313 에서 발견된 치명적 심각도CVSS 9.8의 인증되지 않은 임의 파일 업로드 취약점입니다. supersubmitform nopriv AJAX 핸들러는 다음 없이 양식 제출을 통해 파일 업로드를 허용합니다: 1. 사...

CVE-2015-9357-POC

CVE-2015-9357 WordPress のスマイリー/絵文字パーサーによる保存型 XSS、偽造された nonce リクエストを介した管理者ユーザー作成。 絵文字の正規表現によって 属性コンテキストから抜け出し、onerror ハンドラに JS を埋め込みます。script タグは不要で、影響を受けるフィールド上の wpkses フィルタリングをすり抜けます。 攻撃チェーン: スマイリー変換が適用される任意のフィールドにペイロードを送信し、管理者がそれを閲覧するとそのセッションで XSS が発動し、user-new.php から create-user nonce...

CVE-2026-81852

AshAdmin (ash-project/ash_admin), an Elixir/Phoenix library, shipped a hardcoded CSP nonce (ash_admin-Ed55GFnX) as a compile-time constant when mounted without the :csp_nonce_assign_key option. This value was written verbatim into inline and [removed] tags on every response and was never rotated...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce 未经身份验证的文件上传导致远程代码执行 Nonce泄漏 → certificatecrtpath上传 → 代码执行 概述 CVE-2026-3891 是 Pix for WooCommerce WordPress插件（由linknacional开发）版本 ≤ 1.5.0 中的一个严重级别（CVSS 9.8）未经身份验证 的任意文件上传漏洞。 lknpixforwoocommercec6savesettings AJAX处理程序存在以下问题： 1. 无权限检查 — 任何未经身份验证的访问者均可调用 2. 无文件类型验证...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — 인증되지 않은 권한 상승 8단계 자동화 익스플로잇 | 멀티프로세싱 + Asyncio | 관리자 생성 검증 🎯 취약점 정보 WordPress 플러그인 WP Maps Pro 버전 ≤ 6.1.0에는 인증되지 않은 권한 상승 취약점이 있습니다. 자격 증명 없이도 공격자는 관리자 계정을 만들고 사이트를 장악할 수 있습니다. 이 취약점은 FlipperCode 벤더의 지원 팀을 위해 설계된 "임시 접근Temporary Access" 기능에서 비롯되었지만, 적절한 보호 없이...