CVE-2026-86785 Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

EUVD-2026-85019

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Exposición de Información no Autenticada El plugin g-FFL Cockpit no implementa verificaciones de autorización adecuadas en el endpoint de la API REST serverstatus, permitiendo que usuarios no autenticados accedan a información sensible de configuración del servidor, ajuste...

CVE-2024-10924

CVE-2024-10924 - Bypass de Autenticación en Really Simple Security DESCRIPCIÓN GENERAL Este proyecto demuestra la explotación y mitigación de CVE-2024-10924, una vulnerabilidad crítica de bypass de autenticación en el plugin de WordPress "Really Simple Security". PASO 1: CONFIGURACIÓN DEL ENTORNO...

Updated rest packages fix a security vulnerability

Weak random number generation in pkce implementation. CVE-2026-16615...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Inyección SQL no autenticada El plugin no sanitiza ni escapa un parámetro de una ruta REST antes de usarlo en una sentencia SQL, lo que permite a usuarios no autenticados realizar ataques de inyección SQL script de configuración: 1. git clone...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2017-5487

...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC:...

CVE-2025-1562

CVE-2025-1562 root@kitploit: POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124...

CVE-2026-85055 Twenty: Field-level read bypass

Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...

CVE-2026-25197

CVE-2026-25197: Omisión de Autorización mediante Clave Controlada por el Usuario IDOR Aviso Campo| Valor ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Crítico Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Omisión de Autorización mediante Clave...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Overview WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Plugin Acyber Wordpress !WARNING Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 wp2shell کاهش مخاطره اضطراری و موقت برای زنجیره آسیب‌پذیری wp2shell 🇬🇧 English Description This lightweight WordPress plugin serves as a temporary virtual patch mitigation against the critical...

CVE-2026-75791

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

wordpress-batch-rce-lab

wp2shell: RCE por lotes en WordPress Un análisis técnico de CVE-2026-63030, un fallo lógico en el endpoint de lotes de la API REST de WordPress que permite que una solicitud anónima se envíe bajo la ruta y verificación de permisos de otra solicitud, encadenándose con CVE-2026-60137 inyección SQL...

CVE-2026-75791

ManageEngine ADSelfService Plus (by Zohocorp) versions before build 7001 are affected by an authentication bypass in its REST API . The vulnerability allows unauthenticated remote attackers to bypass authentication, with a CVSS 3.1 score of 8.6 (HIGH) — low attack complexity, no privileges or use...

EUVD-2026-84364

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

wp2shell-scanner

wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner Authorized security-research tool with optional command-verification PoC. wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence,...