WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API 评估 PoC 该仓库包含一个 Python 概念验证脚本，用于验证已报告的未授权 BookingPress Pro REST API 暴露问题。成功响应可能包含预订和客户信息，其中可能包括个人数据。 授权要求 仅可对您拥有或已获明确授权评估的系统使用本项目。未经书面许可，请勿针对公共、第三方或生产系统运行。请将任何检索到的预订数据视为敏感个人信息。 范围 该脚本： 规范化提供的 WordPress 目标 URL。 检查 BookingPress Pro REST API 端点是否存在暴露的预订响应。...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

CVE-2025-69581

CVE-2025-69581 Chamillo LMS 1.11.2 において問題が発見されました。Social Network /personaldata エンドポイントは、適切なキャッシュ制御が欠如しているため、ログアウト後も機密性の高いユーザー情報をそのまま公開します。ブラウザの「戻る」ボタンを使用すると、すべての個人データが復元され、同じデバイス上の権限のないユーザーが機密情報を閲覧できるようになります。これにより、プロファイリング、なりすまし、標的型攻撃、および重大なプライバシーリスクが生じます。発見者：Rivek Raj Tamang RivuDon、インド・シッキム州。...

CVE-2026-36374

描述 已发现一个公共端点，允许使用可预测的标识符（证书代码）进行证书查询，且无需任何身份验证或授权机制。 通过枚举该标识符，攻击者可以访问第三方个人数据，包括全名、CPF（巴西个人纳税人登记号）、RG（巴西身份证号）、出生日期和出生地。 同时还观察到，即使证书持有人选择在专业网络或其他平台上公开分享其带有部分脱敏个人数据的文凭，证书标识符通常仍然可见。通过该标识符，可以直接查询端点并获取完整数据，完全绕过界面中实施的脱敏机制。 受影响的端点 https://www.fiap.com.br/consultadocumento 载荷示例 8 字符标识符 概念验证（PoC）...

EUVD-2026-73766

Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally...

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows i...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

EUVD-2026-63359

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

EUVD-2026-62628

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-17087

The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...

Exploit for CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This reposi...

CVE-2026-14213

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-14213

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

EUVD-2026-57727

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14925 Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

EUVD-2026-57081

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...