CVE-2024-0258

CVE-2024-0258 Technical analysis and public documentation related to CVE-2024-0258 , an Apple libxpc vulnerability. This repository contains research notes, technical observations, reverse engineering findings, and public references intended to document the vulnerability and its security...

WordPress BEAR plugin < 1.2.2 - Taxonomy Term Modification vulnerability

Taxonomy Term Modification vulnerability discovered by Ali Mousavi in WordPress Plugin BEAR versions 1.2.2...

WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin AI for SEO versions = 2.4.2...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-69249 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

CVE-2026-57352

CVE-2026-57352 concerns the WordPress plugin ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce (

WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin GIFT4U versions = 1.0.10...

PT-2026-50372

Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5...

CVE-2026-11416 MoviePilot Path Traversal via Cloud Storage Download Handlers

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-34073 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin Taboola Pixel versions = 1.1.4...

WordPress ExactMetrics plugin 7.1.0-9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update vulnerability

Authenticated Custom Improper Privilege Management to Role Privilege Escalation via Settings Update vulnerability discovered by Ali Sünbül in WordPress Plugin ExactMetrics versions 7.1.0-9.0.2...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter vulnerability

Authenticated Contributor+ Server-Side Request Forgery via 'endpoint' Parameter vulnerability discovered by Ali Sünbül in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.6.1...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload vulnerability

Missing Authorization to Authenticated Contributor+ Unauthorized Media Upload vulnerability discovered by Ali Sünbül in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.6.1...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-26007 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

trends-widget Cross-Site Scripting Vulnerability

Trends-Widget is a plugin developed by Zain Ali, a personal developer for MyBB. Version 1.2 of Trends-Widget contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation for thread titles, which may lead to cross-site scripting attacks...

CVE-2026-1140

A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacte...

CVE-2023-45642

Cross-Site Request Forgery CSRF vulnerability in Hassan Ali Snap Pixel plugin = 1.5.7 versions...

Malicious code in poliaoz-ali-avuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9840d8a1fcd364e2090a3d6dc06a36da790ebfc11b89cc02b3b1e72ec38f0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poliaoz-ali-avanuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90dfe94e6fb80b17413cee1e1877b79e62220e9a55228cd56b5957c8c62f7c22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184850 Malicious code in poliaoz-ali-avuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9840d8a1fcd364e2090a3d6dc06a36da790ebfc11b89cc02b3b1e72ec38f0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...