CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. الكشف العلني لعناوين البريد الإلكتروني للمستخدمين CVE-2025-59843 النطاق / التطبيق المتأثر: تطبيق FlagForge على الويب نقطة نهاية API: /api/user/username التفاصيل: تعيد نقطة النهاية عناوين البريد الإلكتروني للمستخدمين دون مصادقة. يمكن الاستعلام عن أي اسم مستخدم...

Whoisleak

Whoisleak هذه الأداة تستعلم عن عناوين البريد الإلكتروني التي سجلت النطاق وتتحقق مما إذا كانت قد تسربت في بعض عمليات تسريب البيانات. للتثبيت $ apt-get install nodejs-legacy $ pip install -r requirements.txt مثال الاستخدام python whoisleak.py -u securityattack.com.br جهة الاتصال / المدونة Eddy...

ninja-forms-brute

Ninja Forms 3.6.8 - Divulgation d'adresses e-mail sans authentification Description Le plugin ne supprime pas les fichiers temporaires créés lors de l'exportation des soumissions, ce qui pourrait permettre à des attaquants non authentifiés de les télécharger et d'obtenir des informations sensible...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - Divulgation d'informations utilisateur Ce dépôt contient un exploit preuve de concept PoC pour la CVE-2026-53959 Avertissement Ce projet est fourni à des fins éducatives et pour des tests de sécurité autorisés uniquement. Ne l'utilisez pas contre des systèmes qu...

CVE-2023-5612

كشف البريد الإلكتروني العام في خلاصة RSS للعلامات Tags https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ تم اكتشاف ثغرة في GitLab تؤثر على جميع الإصدارات قبل 16.6.6 و16.7 قبل 16.7.4 و16.8 قبل 16.8.1. كان من الممكن قراءة عنوان البريد الإلكتروني للمستخدم...

CVE-2023-6444-POC

CVE-202306444-POC إثبات مفهوم حول الإفصاح عن البريد الإلكتروني للمسؤول دون مصادقة CVE-2023-6444 الاستخدام: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-89030

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

CVE-2026-90934

EspoCRM before 10.0.4 is affected by a field-level security bypass in the meeting and call attendees endpoints. The root cause is incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions, allowing authenticated users to recover restricted email ad...

CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-86407

The User Registration & Membership WordPress plugin in versions before 5.2.8 contains an unauthenticated user data disclosure vulnerability. The plugin fails to verify if a visitor requesting the membership confirmation page owns the account specified in the request or if a valid registration/pur...

CVE-2026-78152

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

EUVD-2026-76809

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152

The SureRank SEO WordPress plugin, versions 1.6.2 through 1.10.0 , contains a vulnerability that allows unauthenticated visitors to obtain the registered account email addresses of users who have published content. This occurs because the plugin fails to exclude these email addresses from the str...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

PT-2026-90563

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

GHSA-CQR2-H44G-V75V n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Impact The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on...

JetBrains YouTrack < 2026.2.18769 Information Disclosure (CVE-2026-86496)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18769. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

EUVD-2026-75137

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...