CVE-2025-56762

Description : L'application utilise "error.php" pour renvoyer le code d'erreur correspondant au cas d'usage vers l'application web lorsqu'une erreur survient. Lors de l'inspection du code source, il a été constaté que l'application ne nettoie pas le paramètre "code" lors de la construction d'un...

exploit_CVE-2023-33831

exploitCVE-2023-33831 CVE-2023-33831 Installation git clone https://github.com/btar1gan/exploitCVE-2023-33831 Utilisation automatic cd exploitCVE-2023-33831/ set your listener python3 33831.py manual nc -lvnp 1881 set your listener on code param copy the 33831.txt to repeater...

CVE-2024-54292

CVE-2024-54292 Appsplate = 2.1.3 - Неаутентифицированная SQL-инъекция Описание Плагин Appsplate для WordPress уязвим к SQL-инъекциям в версиях до 2.1.3 включительно из-за недостаточного экранирования параметра, предоставляемого пользователем, и отсутствия достаточной подготовки существующего...

VulnCheck KEV: CVE-2026-33057

Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard...

PT-2026-98412

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the REST endpoint '/inventory/configuration/variants', where malicious...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...

EUVD-2026-83725

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-78154 the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

PT-2026-65412

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-12800: Improper Neutralization of Special Elements used in an SQL Command

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-6939

The CVE-2026-6939 entry concerns the CorvusPay WooCommerce Payment Gateway for WordPress. It is vulnerable to Unauthenticated Stored Cross-Site Scripting via the approval_code parameter in all versions up to 2.7.4 due to insufficient input sanitization and output escaping. An unauthenticated REST...

CVE-2026-9700 Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-9700 Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-9700

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-42170

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-9700

The CVE covers the WordPress Eventer plugin vulnerability up to version 4.4.2, caused by insufficient escaping of the user-supplied code parameter and inadequate SQL query preparation. This enables time-based SQL injection by unauthenticated attackers to append additional SQL to existing queries ...

PT-2026-56326

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...