WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

Wipro Holmes Orchestrator 20.4.1 - Information Disclosure

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

Anyscale Ray - Remote Code Execution

Anyscale Ray 2.6.3 and 2.8.0 contain a remote code execution vulnerability due to insecure job submission API, allowing attackers to execute arbitrary code remotely if they have network access to the Ray Dashboard API. id: CVE-2023-48022 info: name: Anyscale Ray - Remote Code Execution author:...

bug-bounty-reports-desai-vinayak

🧩 Report Bug Bounty — Desai Vinayak 🔒 Report di bug bounty e ricerca sulle vulnerabilità di Desai Vinayak. Questo repository raccoglie report passivi e non distruttivi su vulnerabilità e prove a supporto per divulgazione coordinata e tracciamento della risoluzione. 📁 Contenuti 📂 reports/ — PDF,...

CVE-2024-8522

CVE-2024-8522 LearnPress – WordPress LMS Plugin execute class-lp-course-db.php:564, LPCourseDB-getcourses Courses.php:241, LearnPress\Models\Courses::getcourses class-lp-rest-courses-v1-controller.php:502, LPJwtCoursesV1Controller-getcourses class-wp-rest-server.php:1230,...

CVE-2023-2732

CVE-2023-2732 Lo scanner delle vulnerabilità delle API WordPress Mstore è uno strumento potente e facile da usare progettato per identificare potenziali vulnerabilità nei siti WordPress ispezionando i loro endpoint API. Lo scanner mira ad aiutare proprietari di siti web, sviluppatori e...

CVE-2025-12721

g-FFL Cockpit = 1.7.1 - Esposizione di informazioni non autenticata Il plugin g-FFL Cockpit non implementa controlli di autorizzazione adeguati sull'endpoint REST API serverstatus, consentendo a utenti non autenticati di accedere a informazioni sensibili sulla configurazione del server,...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

CVE-2018-7691

CVE-2018-7691 Die SSC REST API enthält Schwachstellen bezüglich Insecure Direct Object Reference IDOR, die authentifizierten Benutzern Zugriff auf beliebige Details der lokalen und LDAP-Benutzer über die POST-Methode und auf beliebige Details der Fortify-Projekte anderer Benutzer über die...

CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS يخلط بين بيانات القالب الخالصة وخيارات تكوين المحرك من خلال واجهة برمجة تطبيقات العرض Express. من خلال الكتابة فوق خيارات التكوين الداخلية، قد يتم تشغيل تنفيذ التعليمات البرمجية عن بُعد في التطبيقات النهائية. المصدر...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 è una vulnerabilità di esecuzione remota di codice in Metabase. La vulnerabilità deriva da un difetto di sicurezza nella gestione delle stringhe di connessione JDBC da parte di Metabase quando processa l'endpoint API non autenticato...

HunterScrape

Questo è uno script Python che utilizza l'API di hunter.io per estrarre dati su un dominio target, quindi generare una lista di email target. È utilizzato principalmente per password spraying con strumenti come Go365 o TREVORspray. Usage: HunterScrape-Dev.py -h -d DOMAIN -k KEY -l LIMIT -f -o...

Burp_Collector

Burp Collector Burp Collector ist ein Multi-Processing-Tool, das speziell entwickelt wurde, um Pentester und Bug Bounty Jäger bei Web-/Mobile-Applikationstests zu unterstützen. Mit seinen leistungsstarken Fähigkeiten optimiert es den Prozess des Sammelns und Extrahiertens von Informationen aus Bu...

CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

CVE-2026-13714

Realtyna WPL 5.3.0 - Nicht authentifizierter RCE-Exploit Beschreibung Dieser Exploit zielt auf eine kritische Schwachstelle in den Versionen vor 5.3.0 des Plugins Realtyna Organic IDX + WPL Real Estate ab. Das Plugin verwendet fest verdrahtete Zugangsdaten und erlaubt nicht authentifizierte...

CVE-2026-7458

🧨 CVE-2026-7458 – Bypass de OTP no PickPlugins User Verification Bypass de autenticação não autenticado via comparação frouxa na API REST de verificação de OTP PickPlugins User Verification ≤ 2.0.46 📖 Descrição O plugin User Verification da PickPlugins para WordPress versões ≤ 2.0.46 contém uma...

CVE-2026-23550

🧨 CVE-2026-23550 – Bypass Admin del Connettore Modulare Accesso amministrativo WordPress non autenticato tramite il parametroorigin=mo Plugin Modular Connector ≤ 2.5.1 📖 Descrizione Il plugin Modular Connector per WordPress versioni ≤ 2.5.1 contiene una vulnerabilità critica di bypass...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — Accesso API non autenticato in lettura/scrittura di CyberPanel AI Scanner Template di rilevamento Nuclei per CVE-2026-41473 che interessa le versioni di CyberPanel precedenti alla 2.4.4. Vulnerabilità La funzionalità AI Scanner di CyberPanel espone due endpoint API senza...