CVE-2024-22515-File-Upload-Vulnerability

CVE-2024-22515：Agent DVR 中的文件上传漏洞 信息 描述 在 iSpyConnect.com Agent DVR 5.1.6.0 中，声音文件上传缺乏对文件类型的验证。这允许已认证用户只需在文件打开对话框中切换为所有文件，即可通过上传音频组件上传任何文件类型。 附加信息 此漏洞可与我之前提交的漏洞利用程序进行链式利用，从而实现任意文件上传和任意文件执行。 受影响版本 受影响版本： 5.1.6.0（注意：其他版本也可能受影响） 修复版本 修复版本： 5.1.7.0 研究人员 研究人员： Dylan W. Como 披露 披露链接： GitHub 仓库 参考 NIST...

CVE-2025-31033

⚠️ CVE-2025-31033 - WordPress Buddypress Humanity प्लगइन में CSRF = 1.2 🛡️ भेद्यता सारांश WordPress के लिए Buddypress Humanity प्लगइन संस्करण = 1.2 क्रॉस-साइट रिक्वेस्ट फोर्जरी CSRF के लिए कमजोर है। यह कमजोरी एक हमलावर को उच्च विशेषाधिकार वाले उपयोगकर्ता जैसे, एडमिन को अनजाने में प्लगइन सेटिंग्स...

CVE-2022-23361

Mobile Verification Bypass While Registering a New Account ------ Affected Product JDOmni---- All the Websites Built With JDOmni are Vulnerable. Questo repository è un riferimento pubblico per CVE-2022-23361. Questa vulnerabilità è stata ora corretta dal fornitore. Contattami:- LinkedIn-...

CVE-2026-78146

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Fehlende serverseitige Verifizierung führt zu Authentication-Bypass über die Funktion ringcentraladminlogin2faverify 🚨 CVE-2025-7955 | RingCentral Communications WordPress-Exploit 📝 Schwachstellenübersicht CVE: CVE-2025-7955 Betroffenes Plugi...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

CVE-2026-77000

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

CVE-2026-77002 SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

EUVD-2026-64227

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

CVE-2026-77000 WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-15150

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

EUVD-2026-63910

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

EUVD-2026-63909

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

CVE-2026-15150

The myCred WordPress plugin before 3.2.5 contains an unauthenticated payment bypass in the buyCRED function. The plugin fails to verify that the receiver of an incoming payment gateway notification (e.g., PayPal IPN) matches the site's configured merchant account. An unauthenticated attacker can ...

CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership...

CVE-2026-72398

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...