CVE-2026-81195

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...

CVE-2026-74927

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-77783

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-77782

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

CVE-2026-77785

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-19704

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

CVE-2026-19251

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2020-25078

D-Link DCSシリーズのアカウントパスワード情報漏洩脆弱性 D-Link DCSシリーズのアカウントパスワード情報漏洩脆弱性。スクリプトを使用してアカウントとパスワードを取得しログインします。 脆弱性番号 CVE-2020-25078 ツールの利用 python3 CVE-2020-25078.py -u http://127.0.0.1:1111 単一URLテスト python3 CVE-2020-25078.py -f url.txt バッチ検出 免責事項...

Ctirix_RCE-CVE-2019-19781

CtirixRCE-CVE-2019-19781 Citrix ADC RCE cve-2019-19781 Video Follow us Vulnmachines YouTube Twitter Facebook...

PixelDump_CVE-2016-8462

PixelDump - CVE-2016-8462 PixelDump CVE-2016-8462 は、beaups と Jon 'jcase' Sawyer によって発見/解明された 件の Pixel ブートローダー脆弱性のうちの1つでした。 免責事項 これは、公開するつもりなど一切なかった汚いPOCです。別のプロジェクトをコピーして、数分だけ数行を追加し、バウンティ報酬額を釣り上げるためにGoogleに送ったものです。ダサいです。はい。動きます（動くようなものです）。はい。 繰り返しますが、これはひどいコードです。これが何かに使えると思わないでください。 詳細...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 MinIO敏感信息泄露检测脚本 Usage root@kitploit: go mod tidy go build main.go ./main -u 'http://example.com'...

CVE-2020-35391-POC

CVE-2020-35391-POC へようこそ 👋 Tenda N300 における不正なHTTPリクエストヘッダーを介した認証バイパスのPython PoC Tenda N300 F3 12.01.01.48 デバイスでは、リモート攻撃者が cgi-bin/DownloadCfg/RouterCfm.cfg への直接リクエストにより（httppasswd 行を含む可能性のある）機密情報を取得できます。これは CVE-2017-14942 に関連する問題です。 注：脆弱性レポートでは、RouterCfm.cfg ファイル名の後に ?...

CVE-2023-35636

CVE-2023-35636 Microsoft Outlook 信息泄露漏洞（泄露密码哈希） - Expect Script POC CVE-2023-35636 是 Microsoft Outlook 日历共享功能的漏洞，通过在邮件中添加两个标头，可引导 Outlook 共享内容并连接指定机器，从而有机会截获 NTLM v2 哈希。 启动带有 SMB 服务器的 responder 发送邮件并等待（邮件收件人的防火墙必须允许 SMB（445）流量通过） 用法: ./cve-2023-35636.sh mx.fqdn port emailsender emailrecipient...

CVE-2015-6668

CVE-2015-6668 タイトル: Job-Manager WP Plugin におけるCVファイル名の開示...

libssh security update

An update is available for libssh. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...

EUVD-2026-69852

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

CVE-2026-81199

MasterStudy LMS WordPress Plugin versions before 3.7.46 contain an unauthenticated information disclosure vulnerability in the student/stats REST route . The endpoint fails to perform an authorization check before returning a student's learning statistics, allowing any unauthenticated attacker to...

CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Statistics Disclosure vulnerability

Unauthenticated Student Statistics Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure vulnerability

Subscriber+ Cross-Instructor Order Data Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...