The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.

The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...

CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579

The ImageMagick image manipulation software is vulnerable to a policy bypass in versions prior to 7.1.2-31 and 6.9.13-56 . A crafted image can bypass security policies using coder as the domain, potentially allowing the unauthorized reading of data prohibited by the policy. The issue is addressed...

EUVD-2026-94405

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2025-39247

CVE-2025-39247 대상: HikCentral Professional HCMP, 중앙 VMS 서버 CVE: CVE-2025-39247 — 접근 제어 취약점 CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N 영향받는 버전: V2.3.1 – V2.6.2 및 V3.0.0 수정 버전: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 공개일: 2025-08-28 분석일: 2026-05-21 1. 오픈소스 정보 수집 단계 다운로드 전에 이미 공개된 정보는 다음과...

SEDATED

Проект SEDATED® Sensitive Enterprise Data Analyzer To Eliminate Disclosure направлен на предотвращение попадания в Git конфиденциальных данных, таких как учётные данные и токены пользователей. Оглавление Назначение Настройка Клонируйте SEDATED® Обновите файлы .example Настройте переменные и функц...

CVE-2024-8465-PoC

CVE-2024-8465 – Preuve de concept d'injection SQL Informations sur l'équipe Nom de l'équipe : The Misfits Membres de l'équipe : Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Aperçu Ce dépôt contient une application web vulnérable créée comme preuve de concept PoC pour...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

NoSQLMap

NoSQLMap NoSQLMap est un outil Python open source conçu pour auditer, automatiser les attaques par injection et exploiter les faiblesses de configuration par défaut des bases de données NoSQL et des applications web utilisant NoSQL, afin de divulguer ou cloner les données de la base. Initialement...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-96530

The Optimole WordPress plugin (versions 4.0.0 - 4.2.14 ) contains a vulnerability where it fails to perform a capability check before exposing stored image-optimization account data within a dashboard widget. This flaw allows any authenticated user, including those with Subscriber privileges, to ...

WordPress WPCafe plugin < 3.0.21 - Unauthenticated Product Data Disclosure vulnerability

Unauthenticated Product Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WPCafe versions 3.0.21...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

EUVD-2026-94190

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188

The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...

CVE-2026-86816

The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – Preuve de concept d'injection SQL Informations sur l'équipe Nom de l'équipe : The Misfits Membres de l'équipe : Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Présentation Ce dépôt contient une application web vulnérable créée comme preuve de concept PoC...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...