CVE-2024-0258

CVE-2024-0258 Technical analysis and public documentation related to CVE-2024-0258 , an Apple libxpc vulnerability. This repository contains research notes, technical observations, reverse engineering findings, and public references intended to document the vulnerability and its security...

WordPress BEAR plugin < 1.2.2 - Taxonomy Term Modification vulnerability

Taxonomy Term Modification vulnerability discovered by Ali Mousavi in WordPress Plugin BEAR versions 1.2.2...

WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin AI for SEO versions = 2.4.2...

CVE-2026-57352

CVE-2026-57352 concerns the WordPress plugin ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce (

WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin GIFT4U versions = 1.0.10...

PT-2026-50372

Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5...

CVE-2026-11416 MoviePilot Path Traversal via Cloud Storage Download Handlers

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename...

WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin Taboola Pixel versions = 1.1.4...

WordPress ExactMetrics plugin 7.1.0-9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update vulnerability

Authenticated Custom Improper Privilege Management to Role Privilege Escalation via Settings Update vulnerability discovered by Ali Sünbül in WordPress Plugin ExactMetrics versions 7.1.0-9.0.2...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter vulnerability

Authenticated Contributor+ Server-Side Request Forgery via 'endpoint' Parameter vulnerability discovered by Ali Sünbül in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.6.1...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload vulnerability

Missing Authorization to Authenticated Contributor+ Unauthorized Media Upload vulnerability discovered by Ali Sünbül in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.6.1...

trends-widget Cross-Site Scripting Vulnerability

Trends-Widget is a plugin developed by Zain Ali, a personal developer for MyBB. Version 1.2 of Trends-Widget contains a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation for thread titles, which may lead to cross-site scripting attacks...

CVE-2026-1140

A vulnerability was found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigExceptAli. The manipulation results in buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacte...

CVE-2023-45642

Cross-Site Request Forgery CSRF vulnerability in Hassan Ali Snap Pixel plugin = 1.5.7 versions...

Malicious code in poliaoz-ali-avanuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90dfe94e6fb80b17413cee1e1877b79e62220e9a55228cd56b5957c8c62f7c22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poliaoz-ali-avuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9840d8a1fcd364e2090a3d6dc06a36da790ebfc11b89cc02b3b1e72ec38f0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184850 Malicious code in poliaoz-ali-avuku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9840d8a1fcd364e2090a3d6dc06a36da790ebfc11b89cc02b3b1e72ec38f0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184845 Malicious code in poliaoz-ali-ava0nu0ku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0d1ee6455358f77f62a89beee65196d91078a3aad2ecb3a73fceed4e957d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in piluka-ali-bicupaibai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c622771ca8b3a9918771f607ff318ea9b11bc54ee8d57921958a4718cf1bc4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poli-aki-ali (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494b6c565568a18bbb549c4cdb922ea390e83f564c59c8c5e9becb4a116e16a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...