CVE-2020-8193

Vulnerabilità Citrix ADC Elenco CVE https://support.citrix.com/article/CTX276688 Aggiungi if e while nel codice https://dmaasland.github.io/posts/citrix.html root@kitploit: responsestr = json.dumpsr.headers.dict'store' if r.statuscode == 406 and "Content-Disposition" in responsestr and...

The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.

The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...

SEDATED

Il progetto SEDATED® Sensitive Enterprise Data Analyzer To Eliminate Disclosure si concentra sulla prevenzione della trasmissione a Git di dati sensibili come credenziali utente e token. Indice dei contenuti Scopo Configurazione Clona SEDATED® Aggiorna i file .example Personalizza variabili e...

CVE-2022-0236

CVE-2022-0236 Das WP Import Export WordPress Plugin ist anfällig für die Offenlegung sensibler Daten ohne Authentifizierung, da eine fehlende Berechtigungsprüfung in der Download-Funktion wpieprocessfiledownload in der Datei /includes/classes/class-wpie-general.php vorhanden ist. Dies ermöglichte...

CVE-2026-81335

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-81335

Baserow before 2.3.1 is vulnerable to unauthenticated data disclosure via its Application Builder data sources. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py use a permission class that admits any caller, and DataSourceService.dispatch_data_so...

CVE-2026-79676

A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directorie...

CVE-2026-71084

A flaw was found in mysql-connector-odbc. An unauthenticated attacker with local logon access to the infrastructure where MySQL Connectors executes can exploit this vulnerability. This can lead to a complete denial of service DoS by causing the component to crash repeatedly. Additionally, the...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability

Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress Mobile App for WooCommerce plugin <= 0.4.66 - Subscriber+ Customer Data Disclosure vulnerability

Subscriber+ Customer Data Disclosure vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.66...

CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16568

This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handleexport' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or...

NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass

NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions. id: CVE-2026-24207 info...

WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection

ChatBot plugin for WordPress up to 4.8.9 contains a sqlinjection caused by insufficient escaping and lack of preparation on the $strid parameter, letting unauthenticated attackers extract sensitive data, exploit requires no authentication. id: CVE-2023-5204 info: name: WordPress AI ChatBot WPBot ...

Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

My Calendar < 3.7.9 - Unauthenticated SQL Injection

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mcauth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records. id: CVE-2026-8385 info: name: WordPress W...