EUVD-2023-60550

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

CVE-2023-54358

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at...

CVE-2026-34971

creationtimestamp| type| source ---|---|--- 2026-04-09 21:10:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3ptjezrn2g 2026-04-09 21:22:00+00:00| seen| Telegram/6RgwCZFc4Ae1eVERGO141ZaFCzdAoL4kSRzFJKo9cZLKyo 2026-05-24 21:26:28+00:00| seen|...

CVE-2023-54359

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

CVE-2023-54359 WordPress adivaha Travel Plugin 2.3 SQL Injection via pid

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...

CVE-2023-54359

CVE-2023-54359 affects WordPress adivaha Travel Plugin 2.3. The vulnerability is a time-based blind SQL injection in the pid parameter, exploitable by unauthenticated attackers via the /mobile-app/v3/ endpoint using XOR-based payloads to manipulate queries and potentially expose data or cause den...

CVE-2023-54358 WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at...

CVE-2026-40189

creationtimestamp| type| source ---|---|--- 2026-04-09 18:20:46+00:00| published-proof-of-concept| https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx 2026-04-10 21:24:55+00:00| published-proof-of-concept| Telegram/4ztR6gRcWXk6YwHnamVGk5ZiVkHzJEoA9sdr8vYKwKHNiwI 2026-04-...

EUVD-2026-20978

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS,...

CVE-2026-4338

creationtimestamp| type| source ---|---|--- 2026-04-09 11:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2nprutki27...

CVE-2026-5357

creationtimestamp| type| source ---|---|--- 2026-04-09 04:05:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizwjg3uwt24 2026-04-19 08:33:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjtk5zr37f2c...

CVE-2026-5830

creationtimestamp| type| source ---|---|--- 2026-04-09 02:52:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizshbo33j2i 2026-04-09 03:18:04+00:00| published-proof-of-concept| Telegram/k6H1jBRyYuwqPn43znhK7mg4465TougGvrd7kOsXjIgmqE 2026-05-01 01:37:08+00:00| seen|...

CVE-2026-4124

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...

CVE-2026-4124

CVE-2026-4124 concerns the Ziggeo WordPress plugin (versions ≤ 3.1.1). The vulnerability arises in the wp_ajax_ziggeo_ajax handler, which only checks a nonce (check_ajax_referer) and lacks capability checks via current_user_can(). The nonce ziggeo_ajax_nonce is exposed to all logged-in users thro...

PT-2026-31725

WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at...

CVE-2026-39851

creationtimestamp| type| source ---|---|--- 2026-04-08 22:16:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizd2fxkvu2q...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5892

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5844

creationtimestamp| type| source ---|---|--- 2026-04-08 20:16:06+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-5844 2026-04-09 06:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116373220738589930 2026-04-09 06:00:30+00:00| seen|...