Lucene search
+L

3145 matches found

Cvelist
Cvelist
added 2026/07/31 6:00 a.m.56 views

CVE-2026-14333 Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...

0.00296EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/07/31 6:00 a.m.10 views

CVE-2026-14333

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...

7.5CVSS5.3AI score0.00296EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/31 6:00 a.m.47 views

CVE-2026-14333

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...

5.8AI score0.00296EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/30 6:24 a.m.17 views

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

8.6CVSS0.00339EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/30 6:00 a.m.48 views

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

0.00339EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/30 6:00 a.m.13 views

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

5.9AI score0.00339EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/30 6:00 a.m.42 views

CVE-2026-13395

The Online Scheduling and Appointment Booking System (also known as Bookly ) WordPress plugin, in versions before 27.8 , is vulnerable to an unauthenticated SQL injection . The root cause is the failure to sanitize or properly cast a user-supplied parameter—specifically the staff_id —from front-e...

5.9AI score0.00339EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/07/30 6:00 a.m.11 views

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

5.9AI score0.00339EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/29 4:22 p.m.24 views

EUVD-2026-43726

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure...

7.1CVSS5.8AI score0.00318EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/29 4:22 p.m.12 views

GHSA-4VMM-5QVC-W5P7 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/07/29 4:22 p.m.17 views

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5Affected Software1
GitLab Advisory Database
GitLab Advisory Database
added 2026/07/29 12:00 a.m.19 views

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5Affected Software1
RedhatCVE
RedhatCVE
added 2026/07/28 9:27 p.m.11 views

CVE-2024-5300

A flaw was found in Canonical snapd. The base AppArmor security profile configuration in snapd inadvertently allows strictly confined snap applications to bypass intended sandbox restrictions. This enables a compromised or malicious snap application, when running as root, to access sensitive syst...

5.6CVSS5.8AI score0.00099EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/28 8:53 p.m.18 views

EUVD-2026-44800

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass...

6.8CVSS5.9AI score0.00469EPSS
SaveExploits0References7
Github Security Blog
Github Security Blog
added 2026/07/28 8:53 p.m.18 views

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete...

6.8CVSS6.2AI score0.00469EPSS
SaveExploits0References8Affected Software1
The Hacker News
The Hacker News
added 2026/07/28 2:41 p.m.18 views

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller BMC management interfaces exposing Intelligent Platform Management Interface IPMI protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPM...

7.8CVSS7.2AI score0.7857EPSS
SaveExploits3
Tenable Nessus
Tenable Nessus
added 2026/07/25 12:00 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2024-5300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction...

5.6CVSS5.7AI score0.00099EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/23 12:56 a.m.13 views

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

5.3CVSS6AI score0.00428EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/22 10:55 p.m.27 views

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

8.7CVSS5.6AI score0.00483EPSS
SaveExploits1References9
NVD
NVD
added 2026/07/21 3:16 p.m.17 views

CVE-2024-5300

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

5.6CVSS0.00099EPSS
SaveExploits0References1
Rows per page
Query Builder