CVE-2024-6624

CVE-2024-6624 JSON API User = 3.9.3 - Escalation dei Privilegi non Autenticata Description Il plugin JSON API User per WordPress è vulnerabile all'escalation dei privilegi in tutte le versioni fino alla 3.9.3 inclusa. Ciò è dovuto a controlli impropri sui campi meta personalizzati dell'utente...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Nicht authentifizierte Privilegieneskalation Dies ist ein Python-Skript, das die Schwachstelle CVE-2024-6624 im Plugin JSON API User = 3.9.3 für WordPress ausnutzt. Dieses Tool ermöglicht es nicht authentifizierten Angreifern, neue Benutzer zu registrieren...

novahot

novahot novahot è un framework webshell per penetration tester. Implementa un'API basata su JSON che può comunicare con trojan scritti in qualsiasi linguaggio. Di default, include trojan scritti in PHP, Ruby e Python. Oltre all'esecuzione di comandi di sistema, novahot è in grado di emulare...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 ماسح WordPress نظيف للاستخدام الجماعي لثغرة CVE-2026-1405 🧠 نظرة عامة أداة فحص خفيفة ونظيفة مصممة للتحقق من التعرض لثغرة CVE-2026-1405 عبر أهداف WordPress متعددة. تركز على: فحص سريع لأهداف متعددة مخرجات طرفية نظيفة تصنيف نتائج بسيط سهولة الاستخدام لملفات الأهداف...

Name-That-Hash

➡️ Discord | Site ⬅️ O Sistema Moderno de Identificação de Hashes pip3 install name-that-hash && nth Aplicação Web sem necessidade de instalação 🤔 O que é isto? Alguma vez encontraste um hash como 5f4dcc3b5aa765d61d8327deb882cf99 e te perguntaste que tipo de hash é? 🤔 Name-that-hash vai nomear esse...

CVE-2026-54569

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569

SENAITE.CORE (versions 2.0.0–2.6.0), the core framework for the SENAITE laboratory information management system, permits unauthenticated remote code execution through a two-request chain. State-changing JSON API routes in update.py fail to enforce the senaite.core: Access JSON API permission bef...

PT-2026-82209

Name of the Vulnerable Software and Affected Versions SENAITE.CORE versions 2.0.0 through 2.6.0 Description An unauthenticated remote code execution issue exists in the SENAITE JSON API due to a chain of missing authorization and unsafe evaluation of input. The state-changing routes in...

MINI-Q97P-7R8M-562R

Bulletin has no description...

📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation

WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...

GHSA-PJHX-3C3W-9V23 API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Impact ApiPropertysecurity: ... is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context'cachekey', which is set unconditionally before delegati...

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

CVE-2026-9626

The CVE-2026-9626 entry concerns the WordPress JSON API User plugin (

CVE-2026-9626

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the postcomment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the postcomment function, which passes the attacker-controlled...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the componentsCache process of the JSON:API and HAL item normalizers. An attacker can access attributes intended to be hidden from their user context by making requests that trigger cache...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the componentsCache process of the JSON:API and HAL item normalizers. An attacker can access attributes intended to be hidden from their user context by making requests that trigger cache...

CVE-2026-49858

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. ApiPropertysecurity: ... is evaluated per request...