WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — 预授权RCE警报 🚨 🧩 摘要 ID: CVE-2025-61757 产品: Oracle Identity Manager Oracle Fusion Middleware 组件: REST WebServices 受影响版本: 12.2.1.4.0 & 14.1.2.1.0 严重性: 🔴 严重 — 9.8 CVSS 3.1 发布时间: 2025年10月21日 类型: 关键功能缺少身份验证 CWE-306 🚨 漏洞允许的操作 这是一个预授权远程利用 ： 🌐 可网络利用 🔓 无需登录 👤 无需用户交互 💥 导致系统完全受损 ： 📥 机密性：高 ✏️...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WDS MCP Content Manager versions = 3.10.4...

abdal-lockbox

🔐 Abdal LockBox 🌐 Leer en tu idioma: 🇬🇧 English | 🇨🇳 中文 | 🇷🇺 Русский | 🇪🇸 Español | 🇯🇵 日本語 | 🇮🇷 فارسی | 🇸🇦 العربية | 🇹🇷 Türkçe | 🇩🇪 Deutsch | 🇮🇳 हिन्दी Seguridad. Almacenamiento. Autocompletado. — Un gestor de contraseñas para Android centrado en la privacidad, de Abdal Security Group. Abdal...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

Informe Escrito Posterior al Incidente de Ataque a Oracle SSO/LDAP 2025 Este informe posterior al incidente examina la brecha en la cadena de suministro de 2025 dirigida a la infraestructura de identidad y autenticación de Oracle Cloud. Detalla cómo los actores de amenazas explotaron una...

CVE-2026-22777

CVE-2026-22777 — Inyección CRLF en ComfyUI-Manager - RCE con CVE-2025-67303 Severidad: Crítica CVSS 9.8 Afecta a: ComfyUI-Manager Ejecución de Código Cómo Funciona ComfyUI-Manager expone un endpoint /api/manager/dbmode que acepta un parámetro de consulta value y lo escribe directamente en...

CVE-2026-94405

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

Blind-XSS-Manager

Blind-XSS-Manager Nunca olvides dónde inyectas. Descripción Una extensión de Chrome que realiza un seguimiento de la URL inyectada con payloads de Blind XSS. Añade un valor único para cada payload asignado a la URL y la extensión lo registra cuando se copia. Los payloads son casi los mismos que l...

CVE-2024-5082

概述 此仓库包含 CVE-2024-5082 的 Python 概念验证代码，这是 Sonatype Nexus Repository Manager 2 中的一个远程代码执行漏洞。 该漏洞允许具有足够权限的用户发布特制的 Maven 工件，并将其标记为由 Velocity 内容生成器处理。当检索该工件时，Velocity 模板会被 Nexus 解析，并可能在 Nexus JVM 的安全上下文中执行命令。 根据 Sonatype 的说法： 受影响版本包括 Nexus Repository Manager 2.x 至 2.15.1 ； 该问题已在 2.15.2 中修复； Nexus...

CVE-2026-94405 WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

EUVD-2026-91338

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

CVE-2026-94405

The Shahjada Download Manager WordPress plugin (versions up to 3.3.71 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as a Sensitive Data Exposur...

CVE-2026-94405 WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71...

WordPress Download Manager plugin <= 3.3.70 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Download Manager versions = 3.3.70...

Exploit for CVE-2026-100520

CVE-2026-100520 — Path Traversal → RCE in Laranode File Manage...

CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-37067

CVE-2026-37067 Veno File Manager Project 4.4.9 中 /vfm-admin/admin-panel/view/save-cvs.php 存在不正确的访问控制，允许未经身份验证的攻击者通过特制的 POST 请求从指定日期起提取所有应用程序日志。 https://github.com/user-attachments/assets/fa313c9e-aed2-449f-8e58-22297ba1de82...

EUVD-2026-91257

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-97338 Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...