CVE-2018-25195

CVE-2018-25195 describes an SQL injection vulnerability in Wecodex Hotel CMS 1.0, specifically in the admin login functionality. The issue allows unauthenticated attackers to bypass authentication by injecting SQL code via the username parameter in POST requests to index.php?action=processlogin, ...

CVE-2026-4862

creationtimestamp| type| source ---|---|--- 2026-03-26 10:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxg3ige7z2d 2026-03-27 00:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhysskofyy2w...

CVE-2026-33936

creationtimestamp| type| source ---|---|--- 2026-03-26 09:59:25+00:00| published-proof-of-concept| https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g 2026-03-28 02:39:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi3m65n3lp2n 2026-04-02...

CVE-2026-4847

creationtimestamp| type| source ---|---|--- 2026-03-26 09:54:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxdk5iwkr2d...

CVE-2025-15488

creationtimestamp| type| source ---|---|--- 2026-03-26 09:05:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxar3brtl23...

CVE-2026-4838

creationtimestamp| type| source ---|---|--- 2026-03-26 06:43:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwytil3tk2s...

CVE-2026-1986

creationtimestamp| type| source ---|---|--- 2026-03-26 05:57:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwwau2siz27...

CVE-2026-2931

creationtimestamp| type| source ---|---|--- 2026-03-26 05:18:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwu3lmmly27 2026-03-26 05:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwwejqr3y25 2026-03-26 07:00:50+00:00| seen|...

CVE-2026-4331

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-3328

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize function without class restrictions on...

CVE-2026-4331

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-4331 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-4331

The CVE affects Blog2Social: Social Media Auto Post & Scheduler for WordPress up to version 8.8.2. The resetSocialMetaTags() AJAX path incorrectly validates permissions: it only checks for the 'read' capability and a valid b2s_security_nonce, which are available to Subscriber-level users, due to ...

CVE-2026-4331 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-33183

creationtimestamp| type| source ---|---|--- 2026-03-26 03:07:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwmrt3deo2g...

CVE-2026-28760

creationtimestamp| type| source ---|---|--- 2026-03-26 03:00:15+00:00| seen| https://jvn.jp/en/jp/JVN08057419/ 2026-03-26 07:19:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhx2uv3j7o2p 2026-03-26 09:00:30+00:00| seen|...

CVE-2026-3328

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize function without class restrictions on...

CVE-2026-33918

creationtimestamp| type| source ---|---|--- 2026-03-26 01:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwfpt5zue2x 2026-03-26 19:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhyd4wmxir2f 2026-03-26 19:20:10+00:00| seen|...

CVE-2026-33636

creationtimestamp| type| source ---|---|--- 2026-03-26 01:00:54+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhwfpdaa5w2s 2026-03-26 16:00:58+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/116296309675649424 2026-03-26 22:15:57+00:00| seen|...

CVE-2026-34056

creationtimestamp| type| source ---|---|--- 2026-03-26 01:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwfosxhev2j 2026-03-26 18:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhy7rnoiql2k...