CVE-2026-100514

The WordPress REST API Log plugin affects versions

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-14281

CVE-2026-14281 — WAWP（Automation Web Platform）未认证权限提升 针对 WordPress 插件 Automation Web Platform （automation-web-platform — WAWP / Notifications & OTP for WooCommerce）中 CVE-2026-14281 的 Python 3 PoC。 PoCbit 收录于 PoCbit — 社区目录：https://pocbit.org/pocs/ 运行 PoC 会打印 PoCbit 头部；JSONL 行包含 pocbit、pocbitcatalo...

reburp

reburp Burp 的 API/MCP 功能有限——reburp 是一个 Burp Suite 扩展，将完整的 Montoya API 以本地提供的 OpenAPI REST API 形式暴露出来，专为你的 AI 代理优化。 Issues | Discussions 什么是 reburp reburp 让 Burp Suite 变得可脚本化。它作为 Java 扩展加载，并通过 http://127.0.0.1:9090 上的 HTTP REST API 提供 Montoya API， 附带 OpenAPI 规范和 Swagger UI。你在 Burp...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypass Vulnerability ⚠️ Disclaimer This tool is only for cybersecurity offensive and defensive research and exchange. Please use it in compliance with the Cybersecurity Law！ If the user engages in illegal attacks or other illegal...

CVE-2022-2414

CVE-2022-2414 CVE-2022-2414 POC 1. Replace YOURHOST with your target like below url url = "https://example.com/ca/rest/certrequests"...

BIT-PARSE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; The fflcockpitisallowed function uses a hardcoded IP address base64: My4yMTIuMTg1LjE4Nw==, d...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms This is a SudoWP security fork of the original Crowdsignal Forms plugin. !WARNING Security Notice : The original "Crowdsignal Forms" plugin versions = 1.7.2 contains a critical Missing Authorization vulnerability CVE-2025-69015 allowing authenticated users to modify polls...

CVE-2025-11771

Exploit: Unauthenticated Sale Record Creation Browser console fetch'http://localhost/wordpress/wp-json/tokenico/create-sale-record', method: 'POST', headers: 'Content-Type': 'application/x-www-form-urlencoded' , body: new URLSearchParams networkId: "137", presaleKey: "TESTKEY1234", createdAt:...

CVE-2025-12030

CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress Plugin Keywords: CVE-2025-12030, ACF to REST API vulnerability, IDOR, WordPress security, authenticated exploit, WordPress plugin vulnerability, CWE-639, ACF field modification, authorization bypass, WordPress CVE 2025,...

Rocky Linux 8 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / libslirp / etc (crlsa-2021_0531)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210531 advisory. podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API CVE-2020-14370 Tenable has extracted the preceding...