CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

EUVD-2026-87931

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164

The Event Gallery extension for Joomla (developed by svenbluege.de ) versions

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-96896

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin, in versions before 19.9.7 , contains a vulnerability where it fails to perform an authorization check on the wpmr_ajax_request AJAX action. This allows users with a subsite administrator role on a multisite network to perform...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin (versions before 4.4.8 ) is vulnerable to an authentication bypass. The plugin fails to perform proper capability or ownership checks on several AJAX actions, relying solely on a nonce . This allows users granted access to posting feat...

CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-96896 Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem,...

CVE-2026-96896 Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem,...

CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

WordPress NextScripts: Social Networks Auto-Poster plugin < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion vulnerability

Authenticated Social Account Credential Disclosure and Data Deletion vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NextScripts versions 4.4.8...

WordPress Online Scheduling and Appointment Booking System plugin < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability

Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability discovered by Vũ Quang Huy in WordPress Plugin Bookly versions 28.3...

CVE-2026-97164: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

PT-2026-99534

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description An authenticated user can perform arbitrary path deletion through the clear cache task. By manipulating the images parameter within the cache.process task, it is possible to recursively delete...

CVE-2026-86839: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-78582

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

CVE-2026-78582

Kibana is vulnerable to a Missing Authorization (CWE-862) flaw that allows an authenticated user with Synthetics privileges in a single space to permanently delete Synthetics monitors shared in other spaces where they lack access. If a monitor is associated with a private location, the operation ...