CVE-2026-14281-check

CVE-2026-14281 チェッカー WordPress インストール環境が CVE-2026-14281 の影響を受ける可能性があるかを特定するための、軽量で Windows に優しい Python セキュリティチェッカーです。 このツールはパッシブで非破壊的なチェック を実行します。脆弱性を悪用したり、アカウントを作成したり、権限を変更したり、対象のウェブサイトを改変したりすることはありません。 許可されたセキュリティテスト専用です。 自身が所有しているか、評価の明示的な許可を得ているウェブサイトおよびシステムのみをスキャンしてください。 機能 🔎 WordPress の指標を検...

Exploit for CVE-2026-14281

CVE-2026-14281 Checker A lightweight, Windows-friendly Python...

CVE-2026-14281

The Automation Web Platform (WAWP) plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 4.8.6 . The root cause is a lack of permission enforcement on the POST /wp-json/wawp/v1/signup/ REST route and the absence of a key allowlist in the finish...

CVE-2026-14281 Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

EUVD-2026-66173

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

PT-2026-81855

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users view ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability exists in the country-code lookup endpoint of GazellePW (GazellePosterWall) , specifically in commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote authenticated users possessing users_view_ips privileges can execute arbitrary SQL commands by sending a crafted req...

PT-2026-49413

Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi Save Entries, File Upload & Country Code Field = 1.0.6 versions...

CVE-2026-8143 Booking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters

The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hbcountryiso', 'hbusastateiso', and 'hbcanadaprovinceiso' parameters in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin HBook 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

WordPress Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by babyhack@OPCIA in WordPress Plugin Contact Form Extender for Divi Save Entries, File Upload & Country Code Field versions = 1.0.6...

CVE-2026-0119

The Google Pixel smartphone is affected by a memory corruption vulnerability in the usim_SendMCCMNCIndMsg function within usim_Registration.c . This flaw leads to an out-of-bounds write , which could allow for physical escalation of privilege without requiring additional execution privileges or u...

CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat

CTM360 has identified a rapidly expanding WhatsApp account-hacking campaign targeting users worldwide via a network of deceptive authentication portals and impersonation pages. The campaign, internally dubbed HackOnChat, abuses WhatsApp's familiar web interface, using social engineering tactics t...

IPFire Cross-Site Scripting Vulnerability (CNVD-2025-27637)

IPFire is an open source Linux distribution from the IPFire organization. It is mainly used as a router and firewall. A cross-site scripting vulnerability exists in IPFire that stems from the COUNTRYCODE parameter not being properly cleaned and encoded, which can be exploited by an attacker to...

CVE-2025-34301

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRYCODE parameter when creating a location group. When a user adds a new location group, the application...

CVE-2025-34301

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRYCODE parameter when creating a location group. When a user adds a new location group, the application...

CVE-2025-34301

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRYCODE parameter when creating a location group. When a user adds a new location group, the application...