pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

CVE-2025-13342

CVE-2025-13342 PoC The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This allows attackers to register users and set the default role to administrator. Exploitation becomes...

CVE-2026-81343

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...

CVE-2026-81344

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...

CVE-2026-81344

The ACF Frontend Admin by DynamiApps WordPress plugin, in versions up to and including 3.29.13 , is vulnerable to PHP Object Injection . The root cause is a lack of restriction on which PHP classes can be instantiated during the deserialization of stored post content rendered on public-facing pag...

CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...

CVE-2026-81343 Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...

EUVD-2026-103258

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...

EUVD-2026-103259

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...

CVE-2026-81343

The ACF Frontend Admin by DynamiApps WordPress plugin, in versions up to and including 3.29.13 , is vulnerable to an authorization bypass. The plugin fails to perform a capability check on specific form-submission actions, which allows unauthenticated visitors to submit values through a public fo...

CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...

CVE-2026-81344 Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given ...

PT-2026-116372

Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to restrict the PHP classes that can be instantiated during the deserialization of stored post content rendered on public pages. This allows high-privilege...

PT-2026-116371

Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to perform a capability check on a form-submission action before writing submitted values into the global ACF options store. This allows unauthenticated...

CVE-2026-41582

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-41582

The countly-server component of the Countly product analytics solution is vulnerable to a path traversal vulnerability prior to versions 24.05.50 and 25.03.44 . The root cause is the concatenation of attacker-controlled wildcard paths without containment validation in specific routes located in f...

CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-41582 countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-110701

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-102785

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...