CVE-2026-90964

The Essential Real Estate WordPress plugin, in versions prior to 5.3.5 , is vulnerable to unauthenticated arbitrary email sending. The root cause is a failure to restrict the recipient of one of its contact email actions, which allows an attacker to send emails to arbitrary addresses. These email...

CVE-2026-90964 Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site...

sentryexploit

MobileIron Sentry CVE-2023-38035 information extraction Features Extract company name and contact email Proof of vulnerability Usage ./sentryexploit 192.168.0.10:8443 2023/08/24 21:29:55 Information extracted, appliance is vulnerable: 2023/08/24 21:29:55 Company: XXXX Ltd., contact:...

CVE-2026-96904 AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

EUVD-2026-100870

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-96904

The AWP Classifieds WordPress plugin, in versions prior to 4.4.9 , contains a vulnerability that allows unauthenticated attackers to bypass ownership checks. By referencing a payment transaction on the Place Ad page, an attacker can disclose the private contact email stored on any listing. No spe...

WordPress AWP Classifieds plugin < 4.4.9 - Unauthenticated Listing Contact Email Disclosure vulnerability

Unauthenticated Listing Contact Email Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin AWP Classifieds versions 4.4.9...

CVE-2026-104110: Exposure of Sensitive Information to an Unauthorized Actor

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response...

CVE-2026-96904: Exposure of Sensitive Information to an Unauthorized Actor

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

PT-2026-113699

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-104993

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

EUVD-2026-96054

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104993

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.188 . The root cause is insufficient input sanitization and output escaping of the email (Contact Emai...

CVE-2026-104993 GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

CVE-2026-104993 GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvarname' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitization...

PT-2026-109488

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email Contact Email custom field htmlvar name' parameter in all versions up to, and including, 2.8.188 due to insufficient input sanitizatio...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

EUVD-2026-24485

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...

WWBN AVideo Cross-Site Request Forgery Vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the objects/configurationUpdate.json.php file, which protected the endpoint through...

CVE-2025-43803

Insecure direct object reference IDOR vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows...