CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — 身份验证绕过导致管理员账户接管 漏洞摘要 WordPress 插件 Burst Statistics 版本 3.4.0 至 3.4.1.1 存在一个 未经身份验证的身份验证绕过 漏洞，可导致完全 管理员账户接管 。这个严重缺陷允许了解任何管理员用户名的未经身份验证的攻击者，通过单个 HTTP 请求为该账户生成一个有效的 WordPress 应用密码，从而获得对整个站点的持久管理员级访问权限。 该漏洞源于 class-mainwp-proxy.php 中的...

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

Exploit for CVE-2026-64638

💥 CVE‑2026‑64638 – WordPress XSS2Shell S...

Exploit for CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authenticat...

EUVD-2015-1729

Malware in sbrugna...

EUVD-2016-5503

Malware in sbrugna...

EUVD-2024-50993

Malicious code in bioql PyPI...

EUVD-2025-8234

Malicious code in bioql PyPI...

EUVD-2024-33754

Malicious code in bioql PyPI...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

CVE-2024-11197

The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, t...

CVE-2024-12603

A logic vulnerability in the the mobile application com.transsion.applock can lead to bypassing the application password...

CVE-2025-2489

Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json...

CVE-2025-2489 Insecure storage of sensitive information in NTFS Tool

Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json...

CVE-2025-2489

CVE-2025-2489 affects NTFS Tools 3.5.1 and involves insecure storage of sensitive information. The vulnerability stems from storing the application password in /Users/user/Library/Application Support/ntfs-tool/config.json, enabling an attacker with local access to read the password. Documented im...

CVE-2024-12603

CVE-2024-12603 is a logic vulnerability in the mobile application com.transsion.applock (TECNO/Transsion). The issue allows bypassing the application password. Public records point to a logic flaw in the app that can enable access without the correct password. Available concrete details mention T...

CVE-2023-6409

CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opening the file with EcoStruxure Control Expert...

CVE-2023-6409

CVE-2023-6409 is tied to Schneider Electric EcoStruxure Control Expert (and related Modicon/M580/Process Expert components) and is documented as CWE-798: Use of Hard-coded Credentials. The vulnerability enables unauthorized access to a project file protected by an application password when opened...

WordPress 5.6.x < 5.6.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A potential disclosure of user email addresses. - An RCE POP Chains vulnerability. - A Cross-Site Scripting XSS vulnerability in the post link navigation block. - An issue...