CVE-2023-4279

CVE ID : CVE-2023-4279 漏洞类型 : IP 地址欺骗 描述 : 该插件从可能不可信的请求头中获取客户端 IP 地址，攻击者可以操纵该值，从而隐藏恶意流量的来源。 复现步骤 : root@kitploit: 1. 在用户活动日志 设置中，启用“记录用户的 IP 地址”选项并保存设置。 2. 在浏览器中运行以下代码，并注意后端显示的 IP 地址已被伪造。 await fetch"/wp-login.php", "headers": "content-type": "application/x-www-form-urlencoded", "Client-Ip":...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

reportly

Reportly — это инструмент для отчётов о активности пользователей EntraID. О инструменте Это инструмент, который поможет командам Blue во время облачного инцидента. При запуске инструмента исследователь вводит подозрительного пользователя и временной интервал и получает отчёт, содержащий следующее...

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.2.0-4.0.6...

CVE-2026-18276

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-64810

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking...

CVE-2026-64810

JetBrains IntelliJ IDEA versions prior to 2026.2 are affected by an HTML injection vulnerability in an IDE notification, enabling silent user activity tracking. The issue is described across CVE-2026-64810 records (NVD and CVE listings) with a CVSS 3.1 Base Score of 4.3 (Medium) and user interact...

MAL-2026-7048 Malicious code in @athena-ui-components/user-activity (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-42673

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

CVE-2026-42673

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

EUVD-2026-33690

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

CVE-2026-42673 WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

CVE-2026-42673 WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

CVE-2026-42673

CVE-2026-42673 concerns the WordPress plugin Logtivity (Activity Logs, User Activity Tracking, Multisite Activity Log). Affected versions are up to 3.3.6. The vulnerability is described as an Insertion of Sensitive Information Into Sent Data , enabling retrieval of embedded sensitive data from se...

WordPress plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. WordPress plugins are additional applications that can b...

PT-2026-45460

Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from...

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou in WordPress Plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity versions = 3.3.6...

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Unauthenticated Information Disclosure vulnerability

Unauthenticated Information Disclosure vulnerability discovered by Ronnachai Chaipha rxnr - Reconix Co., Ltd. in WordPress Plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity versions = 3.3.6...

PT-2026-31456

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.115 Description PraisonAI's Agent-to-User A2U event stream server, prior to version 4.5.115, lacks authentication, exposing all agent activity. The create a2u routes function registers several API endpoints...

CVE-2026-35185

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens usertoken, user activity, client IP addresses, and server configuration details. This allows a...