Ch4120N-CVE-Pulse

⚡ Ch4120N CVE Pulse Live CVE PoC Aggregator with Smart Search & Threat Intelligence CVE Pulse automatically discovers, scores, and indexes CVE Proof‑of‑Concepts from GitHub. It enriches them with EPSS scores and CISA KEV data, builds daily snapshots & diffs, and serves a fast, searchable static...

novahot

novahot novahot هو إطار عمل لـ webshell موجه لمختبر الاختراق. يقوم بتطبيق واجهة برمجة تطبيقات API قائمة على JSON يمكنها التواصل مع أحصنة طروادة المكتوبة بأي لغة. بشكل افتراضي، يأتي مزودًا بأحصنة طروادة مكتوبة بلغات PHP و Ruby و Python. بالإضافة إلى تنفيذ أوامر النظام، يمكن لـ novahot محاكاة المحط...

Name-That-Hash

➡️ ديسكورد | الموقع الإلكتروني ⬅️ نظام التعريف الحديث للتجزئة pip3 install name-that-hash && nth تطبيق ويب بدون حاجة للتثبيت 🤔 ما هذا؟ هل سبق لك أن صادفت تجزئة مثل 5f4dcc3b5aa765d61d8327deb882cf99 وتساءلت ما هو نوع تلك التجزئة؟ 🤔 Name-that-hash سيقوم بتسمية نوع تلك التجزئة! 🔥 المميزات 📺 تقييمات...

EUVD-2026-95405

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

CVE-2026-105672

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

CVE-2026-105672

The TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability within the HTTPS JSON API dispatcher on TCP port 443. An attacker located on the adjacent network can exploit this by appending an onboarding-scoped object to a JSON request, effectively bypassing session ve...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Élévation de privilèges non authentifiée Ceci est un script Python qui exploite la vulnérabilité CVE-2024-6624 dans le plugin JSON API User = 3.9.3 pour WordPress. Cet outil permet à des attaquants non authentifiés d'enregistrer de nouveaux utilisateurs et...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Scanner WordPress de masse propre pour CVE-2026-1405 🧠 Aperçu Un scanner propre et léger conçu pour vérifier l'exposition à CVE-2026-1405 sur plusieurs cibles WordPress. Il se concentre sur : l'analyse rapide de multiples cibles une sortie terminal propre une...

CVE-2024-6624

CVE-2024-6624 إضافة JSON API User = 3.9.3 - تصعيد صلاحيات غير موثَّق الوصف إضافة JSON API User الخاصة بووردبريس معرضة لتصعيد الصلاحيات في جميع الإصدارات حتى 3.9.3. ويعود ذلك إلى عناصر تحكم غير سليمة في حقول المستخدم المخصصة. مما يسمح للمهاجمين غير الموثَّقين بالتسجيل كمسؤولين في الموقع. تتطلب...

CVE-2026-97637

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

EUVD-2026-91259

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637

The JSON API Auth plugin for WordPress (versions up to and including 3.1.2 ) is vulnerable to an Authentication Bypass via cached session cookie disclosure. The root cause is that the required PI-Media/json-api parent plugin caches controller dispatch results using only the URI and query string, ...

WordPress JSON API Auth plugin <= 3.1.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Chi Trung Huynh in WordPress Plugin JSON API Auth versions = 3.1.2...

PT-2026-104152

Name of the Vulnerable Software and Affected Versions JSON API Auth plugin for WordPress versions prior to 3.1.3 Description An authentication bypass exists due to cached session cookie disclosure. The PI-Media/json-api parent plugin caches controller dispatch results in transients based only on...

CVE-2026-97637: Improper Authentication

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

VulnCheck KEV: CVE-2026-54569

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...