1127 matches found
CVE-2026-94375
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...
CVE-2026-105995 Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...
CVE-2026-105990
The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7 , is vulnerable to an unauthenticated PII disclosure . The root cause is a lack of authorization checks when exporting stored form submissions. This flaw allows unauthenticated attackers to download sensi...
CVE-2026-105995
The Booking Package WordPress plugin, in versions before 1.7.30 , is vulnerable to an information disclosure flaw. The plugin fails to perform necessary authorization checks before returning stored reservation data. This allows unauthenticated users to access and disclose sensitive information, i...
CVE-2026-105990 Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...
CVE-2026-94375
The Order Export & Order Import for WooCommerce plugin for WordPress (versions
CVE-2026-94375 Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...
EUVD-2026-96098
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing custom...
CVE-2025-65681
CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...
CVE-2023-35078-Exploit-POC
CVE-2023-35078 Exploit POC CVE-2023-35078 Remote Unauthenticated API Access vulnerability has been discovered in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron Core. This vulnerability impacts all supported versions – Version 11.4 releases 11.10, 11.9 and 11.8. Older...
vibe-coding-security
Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...
OWASP-Model-Card-Security-Standard
OWASP Model Card Security Standard Status: Entwurf – Inkubierendes OWASP-Projekt Dieser Standard wird aktiv weiterentwickelt. Beiträge und Feedback sind sehr willkommen. Worum geht es hier? Wenn du ein vortrainiertes Modell von HuggingFace oder einem anderen Repository herunterlädst, vertraust du...
WordPress Track Orders for WooCommerce plugin < 1.2.7 - Unauthenticated PII Disclosure vulnerability
Unauthenticated PII Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Track Orders for WooCommerce versions 1.2.7...
privacy-filter
OpenAI Privacy Filter OpenAI Privacy Filter è un modello bidirezionale di classificazione dei token per il rilevamento e la mascheratura di informazioni di identificazione personale PII nel testo. È pensato per flussi di lavoro di sanitizzazione dei dati ad alto throughput, in cui i team...
CVE-2026-94275
The Track Orders for WooCommerce WordPress plugin (versions before 1.2.7 ) contains an unauthenticated PII disclosure vulnerability. The root cause is a failure to verify order ownership before returning billing details. An unauthenticated attacker can obtain sensitive information, including a cu...
CVE-2026-94275 Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...
CVE-2026-105198 LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...
WordPress Appointment Booking Plugin plugin < 5.7.3 - Unauthenticated Customer PII Disclosure vulnerability
Unauthenticated Customer PII Disclosure vulnerability discovered by Vũ Quang Huy in WordPress Plugin LatePoint versions 5.7.3...
CVE-2026-105198
The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions before 5.7.3 . The root cause is a failure to verify that a caller owns the order referenced by an order-item identifier before rendering the confirmation summary....