54 matches found
📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation
WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...
WordPress JSON API User plugin <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yat in WordPress Plugin JSON API User versions = 4.1.0...
CVE-2026-25714
Gitea is vulnerable to CVE-2026-25714: versions up to 1.26.1 do not consistently apply public-only token filtering in the user orgs API, leaving an incomplete fix for CVE-2025-68941. This allows a public-only token to enumerate private organizations belonging to the token owner, violating scope r...
CVE-2026-9626
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...
CVE-2026-9626
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...
CVE-2026-9626
The CVE-2026-9626 entry concerns the WordPress JSON API User plugin (
PT-2026-54893
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.46.0 MediaWiki versions prior to 1.45.4 MediaWiki versions prior to 1.44.6 MediaWiki versions prior to 1.43.9 Description Sensitive information may be exposed to unauthorized actors. This issue is associated with...
CVE-2026-56276
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidation by supplying a crafted password has...
PT-2026-51151
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2 Description A mass assignment issue exists in the 'PUT /api/v1/user' endpoint. This allows authenticated users to modify the credential field without proper validation. By providing a crafted password hash, an...
CVE-2026-34975 Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header injection vulnerability was discovered in SESService.ts, where user-supplied values for from.name, subject, custom header keys/values, and attachment filenames were interpolated directly into raw MIME...
GHSA-PC73-RJ2C-WVF9 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists...
EUVD-2025-201723
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request...
EUVD-2019-13932
Malware in sbrugna...
EUVD-2018-11853
Malware in sbrugna...
EUVD-2021-19513
Malware in sbrugna...
EUVD-2020-5584
Malware in sbrugna...
EUVD-2025-14753
Malicious code in bioql PyPI...
EUVD-2023-40080
Malicious code in bioql PyPI...