18475 matches found
CVE-2026-69240
creationtimestamp| type| source ---|---|--- 2026-08-03 21:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h 2026-08-03 22:00:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g 2026-08-03 22:35:08+00:00|...
CVE-2026-14682
creationtimestamp| type| source ---|---|--- 2026-08-03 11:23:56+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-14682...
CVE-2026-13506
creationtimestamp| type| source ---|---|--- 2026-08-03 11:22:50+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-13506...
CVE-2026-12817
creationtimestamp| type| source ---|---|--- 2026-08-03 11:22:42+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-12817...
CVE-2026-12852
creationtimestamp| type| source ---|---|--- 2026-08-03 11:22:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-12852...
CVE-2026-12802
creationtimestamp| type| source ---|---|--- 2026-08-03 11:22:37+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-12802...
WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
WordPress Order Listener for WooCommerce plugin before 3.2.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute...
WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting
WordPress W3 Total Cache plugin before 2.1.4 is susceptible to cross-site scripting within the extension parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This can allow an attacker to convince an authenticated admin into clicking a link to run...
ZEROF Web Server 2.0 - Cross-Site Scripting
ZEROF Web Server 2.0 allows /admin.back cross-site scripting. id: CVE-2022-25323 info: name: ZEROF Web Server 2.0 - Cross-Site Scripting author: pikpikcu severity: medium description: ZEROF Web Server 2.0 allows /admin.back cross-site scripting. impact: | Successful exploitation of this...
Schools Alert Management Script - Arbitrary File Read
Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...
DomainMOD 4.13.0 - Cross-Site Scripting
DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...
WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting
The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sqlerror parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute...
CVE-2026-15206
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
EUVD-2026-51933
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
CVE-2026-15206
CVE-2026-15206 affects the SMS Alert WordPress plugin (before 3.9.8). The vulnerability arises because the plugin does not bind the mobile verified session flag to the actually verified phone number. After an attacker verifies an OTP on their own number, the signup/login handler reads an attacker...
CVE-2026-15206
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
CVE-2026-52856
creationtimestamp| type| source ---|---|--- 2026-07-31 19:51:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrxq3akldl23 2026-08-02 07:02:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms3fwwqe6w2e...
CVE-2026-58048
creationtimestamp| type| source ---|---|--- 2026-07-31 17:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxjnjuke42b 2026-07-31 18:00:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jdwwbzeerzdry 2026-08-01 09:22:36+00:00| seen|...