ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

PT-2026-104152

Name of the Vulnerable Software and Affected Versions JSON API Auth plugin for WordPress versions prior to 3.1.3 Description An authentication bypass exists due to cached session cookie disclosure. The PI-Media/json-api parent plugin caches controller dispatch results in transients based only on...

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application これは、Jetpack "設定 " "投稿 " に移動し、"作成 " セクションで、"Jetpack Blocks は、開発者を雇ったり、1行のコードを学んだりすることなく、ウェブサイト訪問者を引き込む高品質なコンテンツを提供する力を与えます。 " を有効にします。 7. WordPres...

wordpress-jetpack-broken-access-control-exploit

wordpress-jetpack-broken-access-control-exploit これは、Jetpack 13.9.1 の破損したアクセス制御の脆弱性（CVE-2024-9926）を悪用する Python3 プログラムです。 免責事項 このツールは、セキュリティエンジニアやアプリセキュリティ担当者がセキュリティ評価を行うことを目的としています。このツールは責任を持って使用してください。このアプリケーションの使用方法について、私は一切責任を負いません。このツールの使用によって生じた損害や、このツールを使用して犯された犯罪についても、私は一切責任を負いません。 脆弱性情報...

CVE-2026-47679 GLPI: arbitrary file deletion

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

CVE-2026-68493

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

CVE-2026-68493

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

EUVD-2026-82623

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

EUVD-2026-81285

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-87860: Missing Authorization

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-92585: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-91774: Missing Authorization

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-82790

Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82788

Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82776

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82781

Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82769

Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82771

Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82773

Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...