843 matches found
Scavenger
Scavenger - OSINT Bot - 3.0 bot in action Intro Just the code of my OSINT bot searching for sensitive data leaks on paste sites. email:password combinations are always collected. It detects sensitive information based on the file searchterms.txt and some regexes in classes/utility.py. Search term...
CVE-2026-110026
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tag...
CVE-2026-110026 Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tag...
EUVD-2026-103391
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tag...
CVE-2026-110026
The Tasty Recipes Lite WordPress plugin, in versions prior to 1.2.11 , is vulnerable to a missing authorization flaw (CWE-862). The plugin fails to properly verify user capabilities during the creation, renaming, and deletion of taxonomy terms. This allows users with permissions as low as Contrib...
CVE-2026-110026 Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tag...
EUVD-2026-103252
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...
CVE-2026-105283
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for...
CVE-2026-105283
The ash_typescript library (versions 0.1.0 to 0.19.0 ) is vulnerable to a Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability. An unauthenticated attacker can trigger an error that lacks a specific handling clause in AshTypescript.Rpc.ErrorBuilder.build_error_resp...
DRUPAL-CONTRIB-2026-194
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...
PT-2026-107763
This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term hierarchy must be...
PT-2026-107744
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...
CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-92243: Improper Neutralization of Input During Web Page Generation
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-94297
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on th...
EUVD-2026-89625
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on th...
CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...
PT-2026-96059
Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...
CVE-2026-93454: Improper Neutralization of Input During Web Page Generation
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...