CVE-2026-77194

The Simple Membership WordPress plugin (versions up to 4.8.0 , with a partial fix in 4.8.1) is affected by an unauthenticated Authentication Bypass that can lead to Administrator Account Takeover in WordPress Multisite environments. The root cause is improper identity verification during the publ...

RestroPress 3.0.0-3.2.1 - Authentication Bypass

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including...

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

CVE-2025-65427

CVE-2025-65427: Authentication Rate Limiting Issue in Dbit N300 T1 Pro CVE ID: CVE-2025-65427 Date: 2025-12-16 Discoverer: Kirubel Product: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Firmware Version: V1.0.0 Description An issue was discovered in the Dbit N300 T1 Pro Easy Setup Wireless...

EUVD-2026-68969

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 🚨 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 📝 Description The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.4.01. This flaw...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Unauthenticated Arbitrary Options Update Description The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated...

CVE-2025-2266

🚨 CVE-2025-2266 — Exploit de Plugin de WordPress 🔍 Resumen de la Vulnerabilidad El plugin Checkout Mestres do WP for WooCommerce para WordPress está afectado por una vulnerabilidad de actualización de opciones arbitrarias sin autenticación en las versiones 8.6.5 hasta 8.7.5. La función vulnerable...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Mecanismo inseguro de restablecimiento de contraseña → Toma de control total de la cuenta de administrador Claves de restablecimiento de contraseña en texto plano almacenadas en la base de datos + Inyección SQL = Toma de control total del administrador 📋...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings Exploit tool for authentication bypass vulnerability in WordPress Service Finder Bookings ≤ 6.0 plugin 📋 Table of Contents About the Vulnerability Technical Details...

CVE-2022-48429_poc

CVE-2022-48429 - YouTrack Stored XSS The reported description of the CVE on the NVD database lacks accuracy. This is a more accurated description: Youtrack version = 2022.3.65373 has a stored Cross-Site Scripting XSS in dashboards. A malicious low-privileged user can create and share a malformed...

CVE-2024-27198

CVE-2024-27198 Auth bypass for TeamCity Server version 2023.11.3 and below. NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-27198 Rapid7 blog post:...

CVE-2026-45156-POC

Hacker Matrix Glitch 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me JWT Signature Bypass Fully Automated Proof of Concept PoC Exploit for Admin Takeover. 📖 The Story Behind every CVE, there's a story. This one was found at 2 AM on a cold winter night, fueled by a breakup mashup on loop. Read the ful...

N-able N-central < 2026.3.1.10 - Authentication Bypass

N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — Toma de control del administrador sin autenticación en SiYuan MCP Prueba de concepto para CVE-2026-66012 CVSS 10.0 Crítico, una vulnerabilidad de autorización faltante en el endpoint MCP Model Context Protocol de SiYuan que permite a un atacante no autenticado lograr la toma de...

cve-2026-9558-poc

CVE-2026-9558 — Inyección de Plantillas de Temas de Mautic del Lado del Servidor SSTI para Tomar Control Completo de Administrador Tabla de Contenidos Descripción general Versiones Afectadas Causa Raíz Análisis Estructura del Repositorio Requisitos Uso Salida Esperada Referencias Descargo de...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin Account Takeover 📋 Vulnerability Information...

CVE-2025-48932-Invision-Community-SQLi-Exploit

🔓 CVE-2025-48932 - Exploit de inyección SQL en Invision Community ⚡ Resumen de la vulnerabilidad crítica CVE-2025-48932 es una vulnerabilidad crítica de inyección SQL ciega no autenticada descubierta en Invision Community versiones ≤ 4.7.20. Este exploit permite a atacantes remotos: 🔍 Extraer...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — Asistente de IA de emlog CSRF → Ejecución de SQL → Toma de control de administrador PoC de la falta de protección CSRF en el endpoint executetool del Asistente de IA de emlog pro, que permite a un atacante aprovechar la sesión autenticada de un administrador para ejecutar SQL...

By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — Toma de Control de Administrador en InfiniteWP Client Toma de Control de Cuenta de Administrador sin Autenticación en WordPress Multisite 📋 Visión General El plugin InfiniteWP Client para WordPress 1.13.6 contiene una vulnerabilidad crítica de omisión de autenticación que afect...