CVE-2019-0986

Security Research for FUN すべて Microsoft Windows OS に焦点を当てています CVE-2019-0986 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0986 上記の脆弱性を報告した際に Microsoft へ送信した PoC です。 この PoC は "User Profile Service" ProfSvc.dll を悪用します。 任意のディレクトリに設定された権限に関係なく、そのディレクトリ内のすべてのファイルを削除します...

CVE-2025-60710

CVE-2025-60710 これは、スケジュールタスク \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration におけるローカル特権昇格の脆弱性のPoCです。 このスケジュールタスクが開始されると、taskhostw.exeプロセスは、C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP ディレクトリを開き、次のフィルターを使用してディレクトリを検索しようとします:...

CVE-2025-60710

CVE-2025-60710 これは、\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration スケジュールタスクにおけるローカル権限昇格の脆弱性の PoC です。 このスケジュールタスクが開始されると、taskhostw.exe プロセスが C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP ディレクトリを開こうとし、次のフィルターを使用してディレクトリを検索します:...

WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion vulnerability

Bookit Staff+ Arbitrary Appointment Deletion vulnerability discovered by hieus in WordPress Plugin BookIt versions 2.6.0.5...

CVE-2026-89413

The Filter Gallery plugin for WordPress (versions ≤ 1.1.4) suffers from an authorization bypass due to improper verification of user authorization before performing a deletion action. Authenticated users with subscriber-level access or above can delete arbitrary gallery records—including associat...

EUVD-2026-82741

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89007: Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-87831

CVE-2026-87831 affects the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin in versions before 7.9.7 . The plugin does not properly validate attachment ownership before deletion, allowing any authenticated user (e.g., a customer) to delete arbitrary media attachments bel...

EUVD-2026-81395

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87831: Missing Authorization

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

EUVD-2026-80194

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

EUVD-2026-80178

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

PT-2026-93295

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the caching mechanism for ld.so removed outdated cache files without properly checking whether the app’s control over the path to the outdated cache was valid within the cache directory. This allowed...

WordPress MDJM Event Management plugin < 1.7.8.5 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile DJ Manager versions 1.7.8.5...

CVE-2026-87919

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

EUVD-2026-76807

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

CVE-2026-87919

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

EUVD-2026-76135

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...