CVE-2022-23361

Mobile Verification Bypass While Registering a New Account ------ Affected Product JDOmni---- All the Websites Built With JDOmni are Vulnerable. This repository is a public reference for CVE-2022-23361. This vulnerability is now fixed by a vendor. Connect with me:- LinkedIn-...

EUVD-2026-75571

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

CVE-2026-87913

The AWS Security Agent MCP server prior to version 0.2.0 is vulnerable to a missing S3 bucket ownership verification , allowing remote attackers to obtain the private source archive of a scanned workspace — including credentials and infrastructure state — by registering a storage bucket whose nam...

CVE-2026-87913 Missing S3 bucket ownership verification in the AWS Security Agent MCP server

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage...

CVE-2026-87912 Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-78083

The SP Property Joomla extension (by joomshaper.com) contains a missing CSRF token verification vulnerability affecting versions prior to 4.1.4 . Specifically, the visitor booking endpoint (properties.booking ) and the agent contact form submission endpoint (agents.sendmail ) processed POST reque...

OSEC-2026-19 JOSE: missing RSA signature verification

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let =...

GHSA-CP3J-M783-3PH5 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...

CVE-2024-22515-File-Upload-Vulnerability

CVE-2024-22515: Agent DVR의 파일 업로드 취약점 정보 설명 iSpyConnect.com Agent DVR 5.1.6.0에서 사운드 파일 업로드에 대한 파일 유형 검증이 부족합니다. 이로 인해 인증된 사용자가 파일 열기 대화상자에서 모든 파일로 전환하기만 하면 업로드 오디오 구성 요소를 통해 모든 파일 유형을 업로드할 수 있습니다. 추가 정보 이 취약점은 이전에 제출한 익스플로잇과 연계되어 임의 파일 업로드 및 임의 파일 실행을 모두 허용할 수 있습니다. 영향을 받는 버전 영향을 받는 버전: 5.1.6.0 참...

CVE-2025-31033

⚠️ CVE-2025-31033 - WordPress Buddypress Humanity プラグイン = 1.2 の CSRF 🛡️ 脆弱性の概要 WordPress 用の Buddypress Humanity プラグイン（バージョン = 1.2）は、クロスサイトリクエストフォージェリ（CSRF） に対して脆弱です。 この脆弱性により、攻撃者は権限の高いユーザー（例：管理者）に、セキュリティの質問や回答などのプラグイン設定を意図せず変更させ、ユーザー検証ロジックを回避させることができます。 🐞 脆弱性の種類 クロスサイトリクエストフォージェリ（CSRF）...

CVE-2026-15398 Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-83537

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - サーバーサイド検証の欠如による認証バイパス（ringcentraladminlogin2faverify 関数） 🚨 CVE-2025-7955 | RingCentral Communications WordPress エクスプロイト 📝 脆弱性の概要 CVE: CVE-2025-7955 影響を受けるプラグイン: RingCentral Communications WordPress 影響を受けるバージョン: 1.5 – 1.6.8 CVSS スコア: 9.8...

CVE-2026-84044

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

DRUPAL-CONTRIB-2026-130

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

EUVD-2026-68119

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

EUVD-2026-68048

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-78146

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...