22 matches found
CVE-2026-53519-PoC
CVE-2026-53519 — Nezha Dashboard Path Traversal & JWT Forgery English | 繁體中文 | 简体中文 This repository contains a Proof-of-Concept PoC exploit for a vulnerability in the Nezha Dashboard that allows unauthenticated path traversal , leading to disclosure of sensitive files including jwtsecretkey and...
CVE-2026-97317 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured...
CVE-2026-97317 Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured...
WordPress Giveaways and Contests by RafflePress plugin < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability
Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Giveaways and Contests by RafflePress versions 1.12.27...
CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length not 16/24/32 bytes is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15...
Exploit for CVE-2026-19949
CVE-2026-19949 — Prueba de concepto documentada y reproducible...
CVE-2026-6895 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'exportsettings' function. This function returns the RES...
WordPress Virusdie plugin <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure vulnerability
Missing Authorization to Authenticated Subscriber+ API Key Disclosure vulnerability discovered by Sushi Com Abacate in WordPress Plugin Virusdie versions = 1.1.7...
CVE-2025-5920: Undefined Security Weakness
The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API...
IBM: SSRF and secret key disclosure found on Turbonomic endpoint
The vulnerability of SSRF and secret key disclosure was found on a Turbonomic endpoint and reported to IBM. The issue was analyzed and remediated...
IBM: SSRF and secret key disclosure found on Turbonomic endpoint
The SSRF and secret key disclosure vulnerabilities found on the Turbonomic endpoint were reported to IBM, analyzed, and remediated...
CVE-2023-0443 AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure
The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked...
CVE-2021-24163 Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form...
CVE-2021-21387
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...
CVE-2021-21387 Partial secret key disclosure, improper safety number calculation, & inadequate encryption strength
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...
CVE-2020-27508: Undefined Security Weakness
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
PT-2020-4103
Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.2.12 Apache CXF versions prior to 3.3.5 Description: The issue is related to the OpenId Connect JWK Keys service in Apache CXF, which can return private key and secret key credentials if the user has configured...
Infineon RSA Library Key Disclosure
The vulnerability of Infineon’s RSA Library is related to errors in generating prime numbers using the RSA algorithm. Exploiting this vulnerability could allow a malicious actor to disclose the secret part of the key...
PT-2017-3914
Name of the Vulnerable Software and Affected Versions Infineon Trusted Platform Module TPM firmware versions prior to 0000000000000422 - 4.34 Infineon Trusted Platform Module TPM firmware versions prior to 000000000000062b - 6.43 Infineon Trusted Platform Module TPM firmware versions prior to...
