CVE-2026-86497

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...

CVE-2026-86497

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...

CVE-2026-86497

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...

EUVD-2026-72513

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...

CVE-2026-86497

JetBrains YouTrack versions before 2026.2.18769 contained a vulnerability in the mailbox configuration flow. Changing a mailbox host did not require re-authentication, allowing a project administrator to exfiltrate stored mailbox credentials . The CVSS 3.1 score is 6.8 (MEDIUM) with a network att...

CVE-2022-43959

CVE-2022-43959 Bitrix Vulnerability CVE-2022-43959 Description Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 AD/LDAP connector module before version 23.100.0 allow remote administrators to discover an AD/LDAP administrative password by reading the sourc...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type Allow: POST Content-Length: 191...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2026-74252

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass J2Commerce comj2store ≤ 4.1.5 — Unauthenticated Attacker Stores XSS Payload That Executes Automatically in Administrator Browser on Page Load SUMMARY J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the gues...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Required Arguments: -u, --url Target WordPress site URL e.g., http://127.0.0.1/wordpress -e, --email Email for the new admin account Optional Arguments: -f, --fname First name default: Pwn -l, --lname Last name default: Admin -r, --role Role to assign default:...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Unauthenticated Privilege Escalation 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Unauthenticated Privilege Escalation 📌 Overview This repository contains a Python proof-of-concept tool for CVE-2025-39459 , affecting the Real Estate 7 WordPress theme in versions...

CVE-2026-0920

CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation A proof-of-concept exploit for CVE-2026-0920 , an unauthenticated privilege-escalation vulnerability in the LA-Studio Element Kit WordPress plugin. The vulnerability allows an unauthenticated attacker to abuse the plugin...

CVE-2026-76581-Detector

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581. The detector does not exploit the authentication bypass, request or replay HMAC values, or create ...

CVE-2025-6934

CVE-2025-6934 🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to Privilege Escalation in all version...

CVE-2019-10708

Scms - SQL Injection exploit.py is a PoC for the CVE-2019-10708 vulnerability, implementing multiprocessing for injection to obtain the database name and backend administrator credentials recommended for versions before 20190401 Usage root@kitploit: 測試是否可注入 python3 exploit.py...

CVE-2025-57819

CVE-2025-57819 Overview of this vulnerability quoted from @jfinstrom here Around 2025-08-21 multiple FreePBX systems began showing errors and later confirmed compromises. Vendor Sangoma/FreePBX Security Team published an advisory on 2025-08-26 urging administrators to restrict public access to th...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...

CVE-2026-82846

CVE-2026-82846 affects the Masteriyo LMS WordPress plugin, versions 1.18.0 through 2.3.3 . The vulnerability is a Stored XSS in course custom fields: the plugin fails to sanitize and escape certain course settings before outputting them on a page accessible to all visitors. Users with the course-...