TChopper

TChopper New technique I have discovered recently and give it a nickname Chop chop to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool. image How it works the tool will get the...

CVE-2026-115541

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded...

CVE-2026-115541

HumHub Community Edition 1.19.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save malicious HTML in their first and last name fields. When another authenticated user clicks "Friends" on that pr...

EUVD-2026-116535

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded...

CVE-2026-118168 MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs...

EUVD-2026-114779

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs...

CVE-2026-118168: Unknown MapPress: The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler…

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs...

PT-2026-134833

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs...

PT-2026-134419

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

PT-2026-134490

Name of the Vulnerable Software and Affected Versions The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News versions prior to 4.1.0 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and abov...

PT-2026-134476

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Sit...

CVE-2026-119761

The Axigen Mail Server WebMail (versions before 10.6.39 and 10.7.1 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the improper neutralization of unescaped sender display names within the conversation view. An unauthenticated remote attacker can send an ema...

CVE-2026-119761 Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

EUVD-2026-112618

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

UBUNTU-CVE-2026-114726

Fix mail header injection via the From display-name in the Bounce resend action...

WordPress MasterStudy LMS WordPress Plugin plugin 3.7.13-3.7.54 - Instructor+ Arbitrary User Display Name Update vulnerability

Instructor+ Arbitrary User Display Name Update vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.13-3.7.54...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...