CVE-2024-1380

CVE-2024-1380 Relevanssi – A Better Search = 4.22.0 - Missing Authorization to Unauthenticated Query Log Export Description The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssiexportlogcheck function...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation Description: The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'xladdoninstallation' functio...

CVE-2025-6440

This repository does not have a README...

CVE-2020-3187

This repository does not have a README...

CVE-2024-2782-PoC

CVE-2024-2782-PoC Prueba de concepto de CVE-2024-2782 El complemento Contact Form Plugin by Fluent Forms para Quiz, Survey y Drag & Drop WP Form Builder para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidad en el endpoint de la API...

cve-2014-2734

This repository does not have a README...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

CVE-2026-108891

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController getUserDetailByUserId handler. This vulnerability allows any authenticated user to access the personal details of other users by providing arbitrary userId values. Exploitation can...

EUVD-2026-97063

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, pho...

CVE-2026-108891 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, pho...

CVE-2026-108888

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability within the SysDepartRoleController exportXls handler. This flaw allows any authenticated user to access the /sys/sysDepartRole/exportXls endpoint. Attackers with the default minimal role can exploit this to dow...

EUVD-2026-97062

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...

CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...

CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download a...

CVE-2026-108886

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController queryChildrenByUsername handler. This vulnerability allows any authenticated user to retrieve account records of other users by supplying arbitrary userId values. Impacted data includes names,...

CVE-2026-108887

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysCommentController exportXls handler. This vulnerability allows any authenticated user to request the /sys/comment/exportXls endpoint to download every sys_comment row. Consequently, low-privilege...

CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...

EUVD-2026-97061

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every syscomment row, including comment text and...

CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone...