CVE-2024-56278

CVE-2024-56278 1️⃣ 组件类型 WordPress 插件 2️⃣ 组件详情 组件名称 WP Ultimate Exporter 受影响版本 ⚠️ 由于“WP Ultimate Exporter”插件是“WP Ultimate CSV Importer”插件的附加组件，因此需要同时安装这两个插件。 1. 使用代码编辑器（快捷键：⇧ ⌥ ⌘ M）创建一篇新文章，内容如下： 2. 导航至 WP Ultimate Exporter 插件的“导出”选项卡。可通过点击 WP Ultimate CSV Importer...

thm-cybersec-portfolio

TryHackMe 笔记 — 网络安全作品集 个人笔记和已完成的 TryHackMe 房间总结。 作为 IT 安全角色学习参考和作品集使用。 已完成的房间 | 房间| 主题 ---|---|--- 01| Linux 权限提升| Linux 提权技术 02| Sudo 缓冲区溢出| CVE-2019-18634 03| OWASP Top 10 2025：IAAA 失败| 访问控制失效、认证失败、日志记录 04| OWASP Top 10 2025：应用程序设计缺陷| 配置错误、供应链、加密、不安全设计 05| OWASP Top 10 2025：不安全的数据处理| 加密失败、注入、反序...

CVE-2026-27949

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...

EUVD-2026-20063

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked fr...

CVE-2026-27949

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...

CVE-2026-27949 Plane Exposes User Email (PII and part of credential) in GET Parameter

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...

CVE-2026-27949 Plane Exposes User Email (PII and part of credential) in GET Parameter

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...

PT-2026-31015

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...

WordPress Front User Submit plugin <= 4.9.5 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Bob Matyas - Automattic in WordPress Plugin WP Front User Submit / Front Editor versions = 4.9.5...

EUVD-2025-199639

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

PT-2025-48073

Name of the Vulnerable Software and Affected Versions Primakon Pi Portal version 1.0.18 Description The application’s /api/V2/pp udfv admin API endpoint does not adequately validate server-side requests. This allows authenticated users with low privileges to impersonate other users, including...

CVE-2025-64065: Improper Authorization

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

CVE-2025-64065

The Primakon Pi Portal 1.0.18 API /api/V2/ppudfvadmin endpoint, fails to perform necessary server-side validation. The administrative LoginAs or user impersonation feature is vulnerable to a access control failure. This flaw allows any authenticated low-privileged user to execute a direct PATCH...

CVE-2025-64065

The Primakon Pi Portal version 1.0.18 contains an access control failure in the /api/V2/pp_udfv_admin API endpoint. Due to a Broken Function Level Authorization and Insecure Design , the administrative LoginAs feature fails to verify the caller's privileges or require a target user's password or ...

CVE-2025-52669

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system...

EUVD-2025-198350

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system...

CVE-2025-52669

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system...