34 matches found
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93662
The Events Manager WordPress plugin, in versions prior to 7.4.5 , is vulnerable to an unauthorized data disclosure flaw. The application fails to enforce proper scope for logged-in event and location searches when a caller provides a custom owner value . This allows a low-privileged user to read ...
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
PT-2026-97720
Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.5 Description An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom owner value. This allows a...
EUVD-2026-80769
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...
CVE-2026-89029 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...
CVE-2026-89029
Adenion Blog2Social is a WordPress plugin that, in versions before 9.1.0 , exposes a user enumeration flaw. The b2s_get_select_mandant_user AJAX handler (in includes/Ajax/Get.php) resolves arbitrary user IDs supplied via the owner parameter to display names without verifying the caller's authoriz...
CVE-2026-23696
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signi...
CVE-2026-6998
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipulation of the argument Owner results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used...
CVE-2026-6997
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page. The manipulation of the argument Owner leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been...
CVE-2026-6998
CVE-2026-6998 affects BDCOM P3310D version 0.4.2, build 10.1.0F (86345). The vulnerability targets an unknown function within the New RMON Statistics Page, where manipulating the Owner argument triggers a cross-site scripting (XSS) flaw. The attack is described as executable remotely, and public ...
CVE-2026-6998 BDCOM P3310D New RMON Statistics cross site scripting
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipulation of the argument Owner results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used...
CVE-2026-6997 BDCOM P3310D New RMON History cross site scripting
A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page. The manipulation of the argument Owner leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been...
BDCOM P3310D 跨站脚本漏洞
The BDCOM P3310D is an Ethernet switch device designed for access layer networks by the BDCOM company in China. The version BDCOM P3310D 0.4.2 10.1.0F Build 86345 contains a cross-site scripting vulnerability. This vulnerability stems from the operation of the Owner parameter in the New RMON...
PT-2026-35173
A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipulation of the argument Owner results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used...
BDCOM P3310D 跨站脚本漏洞
The BDCOM P3310D is an Ethernet switch device designed for access layer networks by the BDCOM company in China. The version BDCOM P3310D 0.4.2 10.1.0F Build 86345 contains a cross-site scripting vulnerability. This vulnerability stems from the operation of the Owner parameter in the New RMON...
CVE-2026-23696: Improper Neutralization of Special Elements used in an SQL Command
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signi...
Windmill SQL注入漏洞
Windmill is a low-code development platform open-source by Windmill Labs, Inc. Versions of Windmill from 1.276.0 to 1.603.2 have a SQL injection vulnerability. This vulnerability stems from the owner parameter in the folder ownership management function, which allows for SQL injection attacks. It...
