User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

CVE-2026-60137

wpsqli - WordPress SQLi 추출기 CVE-2026-60137 WordPress 코어의 authornotin SQL 인젝션 취약점을 악용하는 빠르고 메뉴 기반의 데이터베이스 추출 도구입니다. 이 도구는 REST 배치 라우트 혼동CVE-2026-63030을 활용해 인증 없이 SQLi 싱크에 도달하여, 순수하게 데이터베이스 열거와 덤프에 집중합니다. 목차 개요 취약점 체인 영향받는 버전 기능 설치 사용법 메뉴 옵션 추출 모드 성능 법적 고지 개요 wpsqli는 WordPress 코어의 체인 취약점을 악용하여 인증 없...

CVE-2026-15826

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2026-15826

The User Profile Builder WordPress plugin (≤ 3.16.4) is vulnerable to unauthenticated authentication bypass via type confusion , rated CVSS 9.8 Critical . The root cause is in wppb_log_in_user(), which calls absint() on the return value of wp_insert_user() before the is_wp_error() check. A regist...

EUVD-2026-59593

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

PT-2026-72877

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 3.16.5 Description An authentication bypass exists due to type confusion within the wppb log in user function. When a registration request is submitted using the username parameter with a length between 6...

VulnCheck KEV: CVE-2026-15826

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...

CVE-2018-1000189

A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master...

Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control Project File APX contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the...

GHSA-WF8M-QR47-XC9M Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control Project File APX contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the...

CVE-2023-28685

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-28685

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Xxe

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Jenkins Plugins AbsInt a³ 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-28685

CVE-2023-28685 affects Jenkins AbsInt a³ Plugin (≤1.1.0). It does not configure its XML parser to prevent XML External Entity (XXE) attacks, enabling potential disclosure of secrets from the Jenkins controller via crafted XML. CVSSv3.1 base score 7.1 (HIGH): Network attack vector, LOW privileges ...

CVE-2023-28685

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin

A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master...

GHSA-C9PX-7J36-F35V CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin

A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master...

CloudBees Jenkins Absint Astree Plugin Command Execution Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Absint Astree Plugin is used in one ...