CVE-2026-87842

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...

CVE-2026-84099

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-2026-87916 WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

CVE-2026-87916

The WPBot WordPress plugin (versions 8.4.9 through 8.5.9 ) is affected by an unauthenticated PII disclosure vulnerability. The root cause is a missing capability or nonce check on the AJAX action that lists stored chat sessions. An unauthenticated attacker can retrieve the name, email address, an...

EUVD-2026-76800

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...

CVE-2026-87842

Zonify WordPress plugin (versions before 1.0.5 ) lacks a capability or authentication check before returning the site's stored account login token . This allows an unauthenticated attacker over the network to retrieve the token and authenticate to the site owner's linked service account, resultin...

CVE-2026-87842 Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account...

EUVD-2026-76794

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

EUVD-2026-76808

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-76816

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-Newgen-Software-Advisories

Newgen Software – Pruebas de Concepto de CVE Este repositorio contiene material de Prueba de Concepto PoC y documentación técnica para múltiples vulnerabilidades CVE descubiertas en productos desarrollados por Newgen Software Technologies Limited. Las vulnerabilidades documentadas aquí son CVE...

CVE-2025-34171

CVE-2025-34171：CasaOS 中未经身份验证的文件与调试数据暴露 漏洞概述 字段| 值 ---|--- CVE 编号| CVE-2025-34171 影响版本| CasaOS ≤ 0.4.15 修复版本| 无可用补丁 严重性| 中危 CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-862：缺少授权，CWE-497：向未经授权的控制范围暴露敏感系统信息 执行摘要 CasaOS 0.4.15 及更早版本包含多个未经身份验证的 API...

CVE-2020-14181

CVE-2020-14181 受影响版本的 Atlassian Jira Server 和 Data Center 允许未认证用户通过 /ViewUserHover.jspa 端点中的信息泄露漏洞枚举用户。此漏洞由 Positive Technologies 的 Mikhail Klyuchnikov 发现。 受影响版本： 版本 7.13.16 8.0.0 ≤ 版本 8.5.7 8.6.0 ≤ 版本 8.12.0 修复版本： 7.13.16 8.5.7 8.12.0 针对 CVE-2020-1481 的 PoC - Jira 用户名枚举器/验证器 用法： root@kitploit:...

CVE-2026-85706

GitLab CE/EE (18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1) is affected by a critical unauthenticated arbitrary file read (CVSS 10.0) in the repository commits and files API. The root cause is a parser differential between the Go reverse proxy Workhorse (matching routes on percent-encoded paths) and...

CVE-2026-85706 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing...

CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 安全研究，记录了 IBERMATICA RPS 2019 中一个未认证的信息泄露漏洞和一个加密设计缺陷。 这些漏洞可以串联利用，从而暴露包含与身份验证相关的 SQL 查询的应用程序日志，并从可逆的 AES-CBC 密文中恢复用户密码。 免责声明 本仓库仅供安全研究、防御性验证和教育目的使用。请仅在你拥有或已被明确授权评估的系统上进行测试。 摘要 未认证的用户可以访问位于以下地址的 RPS 服务状态页面： root@kitploit: /RPS2019Service/status.htm...

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus 版本 4.3.3 在 Windows 10 上的认证绕过 PoC。 影响所有 Windows 版本 PoC 视频 复现步骤 1. 断开与企业网络的连接 2. 连接到自己的热点 3. 点击重置密码；如果在内网托管了密码重置 Web 应用程序，厚客户端浏览器应报 404 错误 4. 点击搜索该站点，应打开一个新的 Internet Explorer 窗口 5. 按 Ctrl S 打开资源管理器，浏览到...

PT-2026-90580

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...