CVE-2025-6440

🧨 CVE-2025-6440 – WooCommerce Designer Pro Unrestricted File Upload Unauthenticated Arbitrary File Upload viawcdpsavecanvasdesignajax WooCommerce Designer Pro plugin – Remote Code Execution RCE 📖 Description The WooCommerce Designer Pro plugin for WordPress contains an unauthenticated arbitrary...

CVE-2023-25202

CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion

The News & Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdpgetmorepost function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data. id: CVE-2023-5815...

TEN Framework - Arbitrary File Read & Write

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication. id: CVE-2026-85688 info: name: TEN Framework -...

WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read

WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. id: CVE-2025-10897 info: nam...

Disclosures

Disclosures This repository contains my vulnerability reports which aren't under an NDA or restricted by VRP terms of service. Contents Fancy Product Designer Microsoft Xfinity...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Unauthenticated Arbitrary File Upload Description WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation i...

phpmyadmin-setup-validate

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-setup-validate Write-up: https://abraxaslabs.tech/research/phpmyadmin-setup-validate phpmyadmin-setup-validate Class: SSRF Reach: Remote phpMyAdmin 5.2.3 tag RELEASE523, commit 962857e. setup/index.php dies...

WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502

CVE-2025-14502 Vulnerability Analysis Report Vulnerability Overview Vulnerability Type : Local File Inclusion LFI Affected Versions : News and Blog Designer Bundle 1.1 and all earlier versions Severity : High Attack Complexity : Low no authentication required Vulnerability Principle Analysis 1...

phpmyadmin-vqb-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-vqb-xss Write-up: https://abraxaslabs.tech/research/phpmyadmin-vqb-xss phpmyadmin-vqb-xss Class: Stored XSS Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin js/src/designer/history.js builds...

CVE-2025-6440-Poc-Exploit

WC Designer Pro — Unauthenticated Arbitrary File Upload Security Research Proof of Concept A non-destructive proof of concept for an unauthenticated arbitrary file-upload vulnerability affecting the WC Designer Pro WordPress plugin. Table of Contents Vulnerability Overview Security Impact Affecte...

CVE-2025-10897

CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-106133

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability...

CVE-2026-106133 Incorrect Authorization in Telerik Report Server Web Report Designer

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability...

EUVD-2026-123631

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability...

CVE-2026-106133

Progress Telerik Report Server prior to version 12.3.26.1110 is vulnerable to an incorrect authorization vulnerability in the Web Report Designer . This flaw allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, impacting their integri...

CVE-2026-106133: Progress Software Telerik Report Server: In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web…

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability...