EUVD-2025-200104

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel...

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Summary An IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk...

CVE-2025-10732

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

CVE-2025-10732

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

CVE-2025-10732

The CVE concerns the WordPress plugin SureForms – Drag and Drop Form Builder for WordPress. Affected versions: all up to 1.12.1. Root cause: improper access control on the REST endpoint /wp-json/sureforms/v1/srfm-global-settings, allowing authenticated users with contributor-level access and abov...

EUVD-2025-34138

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

CVE-2025-10732 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint...

Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Prestashop

CVE-2025-51586 - PrestaShop AdminLogin Email Enumeration PoC...

EUVD-2025-30838

Malicious code in bioql PyPI...

EUVD-2024-52508

Malicious code in bioql PyPI...

CVE-2024-12575

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'aysfinishpoll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information...

CVE-2024-12575 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'aysfinishpoll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information...

CVE-2024-12575 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'aysfinishpoll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information...

PT-2025-33517 · WordPress · The Poll Maker – Versus Polls

Name of the Vulnerable Software and Affected Versions: Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions up to and including 5.8.9 Description: The WordPress plugin is susceptible to Basic Information Exposure via the ays finish poll API endpoint. This allows...

CVE-2024-54388

Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...

CVE-2024-54388

Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...

CVE-2024-54388

CVE-2024-54388 is described as a CSRF to stored XSS vulnerability in the WordPress plugin 'Multiple Admin Emails' (vulnerable up to version 1.0). Public connected documents identify this CVE with explicit vulnerability type and affected software, but do not provide concrete exploit details or rem...

CVE-2024-54388 WordPress Multiple Admin Emails plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...

PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails

Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality...

CVE-2024-54388: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through = 1.0...