CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCE Exploit أداة استغلال آلية بلغة Python لـ CVE-2025-8110 في Gogs. تسمح هذه الثغرة بتنفيذ الأوامر عن بُعد RCE عن طريق استغلال واجهة برمجة التطبيقات PutContents، التي تفشل في التحقق مما إذا كان مسار الملف رابطًا رمزيًا. من خلال الكتابة فوق الملف الداخلي .git/config عبر رابط رمز...

CVE-2023-27742

CVE-2023-27742 Il a été découvert qu'IDURAR ERP/CRM v1 contient une vulnérabilité d'injection SQL via le composant /api/login. Description Il a été découvert qu'IDURAR ERP/CRM v1 contient une vulnérabilité d'injection SQL via le composant /api/login. Type de vulnérabilité Injection SQL Vendeur du...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

EUVD-2026-94186

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816

The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...

EUVD-2026-94176

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2025-12721

g-FFL Cockpit 'returntrue', le rendant complètement accessible à tout visiteur non authentifié. Situé dans class-sync-endpoint.php : 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue',...

CVE-2025-65427

CVE-2025-65427: Problème de limitation du débit d'authentification dans le Dbit N300 T1 Pro CVE ID: CVE-2025-65427 Date: 2025-12-16 Découvreur: Kirubel Produit: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Version du firmware: V1.0.0 Description Un problème a été découvert dans le routeur Db...

CVE-2026-96594

A flaw was found in Gitea. The repository media application programming interface API endpoint does not return appropriate content-type and disposition security headers when serving small files directly from a repository. An authenticated attacker with repository push access can commit a maliciou...

CVE-2026-105268

A flaw was found in Gitea. The Application Programming Interface API endpoints handling issue attachments improperly process attachments associated with comments on that issue. An authenticated user who created an issue can exploit this flaw to rename or delete attachments posted by other users i...

CVE-2023-43208

CVE-2023-43208 — ثغرة تنفيذ أوامر عن بعد في Mirth Connect أداة إثبات المفهوم لثغرة CVE-2023-43208 ، وهي ثغرة تنفيذ أوامر عن بعد غير مصادق عليها في Mirth Connect الإصدارات التي تسبق 4.4.1. الوصف Mirth Connect هو محرك تكامل رعاية صحية مفتوح المصدر واسع الانتشار. تستغل هذه الثغرة خلل إلغاء التسلسل ف...

CVE-2024-10924

CVE-2024-10924 - تجاوز المصادقة في Really Simple Security نظرة عامة يعرض هذا المشروع استغلال وتخفيف تأثير CVE-2024-10924، وهي ثغرة حرجة في تجاوز المصادقة في إضافة WordPress "Really Simple Security". الخطوة 1: إعداد البيئة ابدأ بيئة WordPress المستضعفة: cd...

CVE-2026-106422

An incorrect authorization flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/519458746...

IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution

IBM Aspera Faspex through 4.4.2 Patch Level 1 is susceptible to remote code execution via a YAML deserialization flaw. This can allow an attacker to send a specially crafted obsolete API call and thereby execute arbitrary code, obtain sensitive data, and/or execute other unauthorized operations...

XWiki REST API Query - SQL Injection

A SQL injection vulnerability exists in XWiki's REST API query endpoint. An unauthenticated attacker can execute arbitrary SQL queries through the 'q' parameter by manipulating the HQL query, potentially leading to data exfiltration or system compromise. id: CVE-2025-32969 info: name: XWiki REST...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...