145 matches found
CVE-2026-7701 Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference
A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/urlauthbox.cpp of the component Bot API. The manipulation of the argument loginurl leads to null pointer dereference. It is...
CVE-2026-2144
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename QRCode.png in the publicly accessible WordPress uploads...
CVE-2026-2144
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename QRCode.png in the publicly accessible WordPress uploads...
CVE-2026-2144
Summary: The Magic Login Mail or QR Code plugin for WordPress (affected up to v2.05) stores the magic login QR code image as a predictable, static file (QR_Code.png) in the publicly accessible uploads dir during email sending. The file is deleted only after wp_mail() completes, creating a race co...
CVE-2026-2144 Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename QRCode.png in the publicly accessible WordPress uploads...
CVE-2026-1398
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
EUVD-2026-4894
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
CVE-2026-1398
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
CVE-2026-1398 Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
CVE-2026-1398
CVE-2026-1398 describes a CSRF vulnerability in the WordPress plugin Change WP URL. The issue arises from missing or incorrect nonce validation on the Change WP URL page, allowing unauthenticated attackers to change the WP Login URL via forged requests if a site administrator clicks a crafted lin...
CVE-2026-1398 Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
PT-2026-5097
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...
CVE-2026-24578
CVE-2026-24578 is a Missing Authorization (Broken Access Control) issue in the WordPress plugin Admin login URL Change. Affected versions 1.1.5 or apply vendor-provided fixes as they become available. Monitor advisories (e.g., Patchstack, CVE listings, PT Security writeups) for any updated impac...
CVE-2026-24578
Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through = 1.1.5...
Exploit for Missing Authentication for Critical Function in Jetbrains Teamcity
Bash Command Examples Batch Scanning python teamcit...
EUVD-2025-38438
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...
CVE-2025-12916
CVE-2025-12916 affects Sangfor Operation and Maintenance Security Management System 3.0, specifically the Frontend component’s /fort/portal_login. The vulnerability arises from manipulating the loginUrl argument, enabling remote command injection. Public disclosures indicate exploitation is possi...
CVE-2025-11189
The Kiwire Captive Portal contains a reflected cross-site scripting XSS vulnerability within the login-url parameter, allowing for Javascript execution...
