CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Carga Arbitraria de Archivos No Autenticada Descripción El plugin WooCommerce Designer Pro para WordPress, utilizado por el tema Pricom - Printing Company & Design Services de WordPress, es vulnerable a cargas arbitrarias de archivos debido a la...

EUVD-2026-68931

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2021-41730

TENDA — Ejecución remota de comandos sin autorización Autor del exploit: SHENGXI [email protected] Vendedor: TENDA CVE-2021-41730 - /bin/httpd Versión del firmware: AC15: =USAC15V1.0BRV15.03.05.20multiTDE01.bin AC6: USAC6V1.0BRV15.03.05.16multiTD01.bin ....... Enlace del hardware:...

CVE-2026-82874

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization I...

CVE-2026-82870

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

CVE-2026-82871

ToolJet versions before v3.16.208 fail to validate organization membership in database read routes. Any authenticated user can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read stored data from victim organizations. T...

CVE-2026-82870

ToolJet before v3.16.208 contains a cross-tenant database manipulation vulnerability caused by missing organization-resolving guards in its database write and destroy routes. Any user with a builder-role can bypass organizationId ownership validation, allowing them to create, alter, or permanentl...

EUVD-2026-68404

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint. The endpoint grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation , allowing an attacker to read arbitrary tables from any workspace...

CVE-2026-75458

XueZhiSi Open Source Exam System versions 3.9.0 and earlier contain a vertical privilege escalation vulnerability in the teacher-end endpoint POST /api/teacher/user/delete/{id} . The endpoint accepts a user ID and performs a deletion sequence (getUserById, setDeleted, updateByIdFilter) without va...

CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2024-50482

CVE-2024-50482 WooCommerce Product Design = 1.0.0 - Nicht authentifizierter beliebiger Dateiupload Beschreibung: Das WooCommerce Product Design Plugin für WordPress ist anfällig für beliebige Dateiuploads aufgrund fehlender Dateityp-Validierung in allen Versionen bis einschließlich 1.0.0. Dies...

CVE-2026-23008-Solidity-Assembly-Return-Data-Size-Confusion

CVE-2026-23008 – Confusão de Tamanho de Dados de Retorno em Assembly Solidity Código do Programa Solidity root@kitploit: // ReturnSizeConfusion.sol contract Victim function callExternaladdress target external returns bytes memory bool success, bytes memory ret =...

CVE-2026-5201

CVE-2026-5201 Overflow del buffer basato su heap nel caricatore JPEG di gdk-pixbuf Ciao, sono Kağan Çapar. Ho scoperto una vulnerabilità di overflow del buffer basato su heap nel caricatore di immagini JPEG di gdk-pixbuf che colpisce praticamente tutti gli ambienti desktop Linux. Alla vulnerabili...

CVE-2025-65094

CVE-2025-65094: WBCE CMS è vulnerabile all'escalation dei privilegi tramite manipolazione dell'ID del gruppo IDOR Panoramica Campo| Dettagli ---|--- CVE ID| CVE-2025-65094 Gravità| ALTA Avviso| Visualizza avviso Scoperto da| Lukasz Rybak Prodotti interessati WBCE/WBCECMS Dettagli Riepilogo Un...

CVE-2024-50473

CVE-2024-50473 Ajar in5 Embed = 3.1.3 - Upload Arbitrário de Arquivos Não Autenticado Descrição: O plugin Ajar in5 Embed para WordPress está vulnerável a uploads arbitrários de arquivos devido à falta de validação do tipo de arquivo em todas as versões até, e incluindo, 3.1.3. Isso possibilita qu...

CVE-2025-6058

⚡ WPBookit = 1.0.4 - Caricamento Arbitrario di File Non Autenticato 📝 Descrizione Il plugin WPBookit per WordPress è vulnerabile al caricamento arbitrario di file a causa della mancata validazione del tipo di file nella funzione imageuploadhandle, che viene agganciata tramite la route...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Übersicht CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 ist anfällig für authentifizierte beliebige Datei-Uploads , die es Angreifern mit Subscriber+ -Rechten...

CVE-2026-80722

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

CVE-2026-80674

CVE-2026-80674 is a critical (CVSS 9.8) vulnerability in the Linux kernel NTFS driver . The ntfs_read_locked_inode() function copies a resident $ATTRIBUTE_LIST into the inode's attribute list via a plain memcpy() with no validation . Subsequent attribute-list walks (ntfs_external_attr_find(), ntf...