167971 matches found
PT-2026-107847
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...
exploit-CVE-2018-15139
Exploit do OpenEMR CVE-2018-15139 OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the shell to be uploaded Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples:...
CVE-2026-89322
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...
CVE-2022-1329
WordPress प्लगिन - Elementor 3.6.0 3.6.1 3.6.2 दूरस्थ कोड निष्पादन Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo xuống chọn phiên b...
Security Bulletin: Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Summary Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...
CVE-2026-76280
Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are vulnerable to an incorrect permission assignment in App Key Value Store (KV Store) collections. An authenticated user without "admin" or "sc_admin" roles ...
GHSA-P96C-XWX8-3CQJ Payload has a tenant authorization bypass in Multi-Tenant Plugin
Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...
EUVD-2026-93506
Payload has a tenant authorization bypass in Multi-Tenant Plugin...
EUVD-2026-93507
Payload external upload trust validation issue...
EUVD-2026-93510
@payloadcms/plugin-multi-tenant has a cross-tenant create issue...
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...
GHSA-XHM9-GWGW-3Q2Q @payloadcms/plugin-multi-tenant has a cross-tenant create issue
Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...
EUVD-2026-93511
Payload: Incomplete validation during the upload file lifecycle...
EUVD-2026-93513
Payload: Client uploads could overwrite S3 objects...
EUVD-2026-92766
Ghost: Path Traversal via Locale Setting...
Ghost: Path Traversal via Locale Setting
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...
GHSA-M382-6JW4-FMP6 Ghost: Path Traversal via Locale Setting
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...
GHSA-JJ74-HC2Q-XRVM Ghost: Remote Code Execution via Theme Translation Files
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...
Ghost: Remote Code Execution via Theme Translation Files
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...