EUVD-2026-111819

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-111742

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

EUVD-2026-111598

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-111744

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit...

EUVD-2026-111748

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

poc-cve-2025-29927

Next.js Middleware Bypass CVE-2025-29927 Proof of Concept This repository contains a proof of concept POC for CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware. 📋 Table of Contents 1. Running the POC Application 2...

CVE-2025-29927

CVE-2025-29927 — Next.js middleware authorization bypass Summary: vulnerability in Next.js middleware allowing authorization bypass by spoofing the x-middleware-subrequest header. Table of Contents CVE-2025-29927 — Next.js middleware authorization bypass Table of Contents Gathering vulnerable hos...

Thank-u-Next

Thank u Next – CVE-2025-29927 Exploit Tool 🧠 What is CVE-2025-29927? It’s not just a bypass — it’s a revelation. A single header, misunderstood and mishandled by middleware logic, becomes a master key to what was meant to be locked. CVE-2025-29927 exploits a misconfigured middleware authorization...

CVE-2026-85655

The Enable Media Replace plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 4.2.2 . The root cause is the doReplaceQuery() method, which fails to perform per-post capability checks when performing a database-wide search-and-replace of media URLs. This al...

Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927

Vulnerable Next.js App for Pentesting Practice This is a Next.js application intentionally designed to be vulnerable to CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability. ⚠️ Disclaimer This application is for educational and ethical hacking purposes only. Do not deploy it t...

instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...

CVE-2026-111213

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 2.3.6 . The root cause is the plugin's failure to properly verify user permissions when performing actions, specifically allowing authenticate...

CVE-2026-111213 Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-110020

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 7.1.6 . The root cause is the plugin's failure to properly verify user permissions when performing specific actions. This flaw allows authenticated attackers with...

CVE-2026-110020 Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-111372

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 5.0.0 . The root cause is the failure to properly verify user authorization for the qcld_rag_manual_sync AJAX action. This allows authenticated attackers with...

CVE-2026-111372 AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit...

CVE-2026-76058

The PayPal Brasil para WooCommerce plugin for WordPress (versions up to and including 1.7.8 ) is vulnerable to an authorization bypass (CWE-862). The flaw occurs because the plugin fails to properly verify user permissions when performing specific actions, specifically the 'bcdc_activation_update...

CVE-2026-76058 PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disab...

CVE-2026-26417

CVE-2026-26417 Broken Access Control in Password Reset Functionality Vulnerability Summary A broken access control vulnerability was identified in Tata Consultancy Services TCS – Cognix Recon Client v3.0. The issue allowed authenticated users to reset passwords of arbitrary user accounts by...