secveri-cve-2026-50011-positive

This repository does not have a README...

CVE-2025-5701

CVE-2025-5701 HyperComments = 1.2.2 - Unauthenticated Subscriber+ Arbitrary Options Update Description The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...

CVE-2026-3326

This repository does not have a README...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability

Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability discovered by AlexHenry in WordPress Plugin Spectra versions = 2.20.4...

CVE-2024-5083

This repository does not have a README...

CVE-2026-41452-PoC

CVE-2026-41452 — Krayin CRM Installer Auth Bypass → Admin Takeover CVSS 9.8 Critical · CWE-287 / CWE-306 · Jiva writeup · VulnCheck Summary Krayin CRM's installer exposes POST /install/api/admin-config-setup plus run-migration, run-seeder without CSRF protection withoutMiddleware'web' group. The...

CVE-2020-11794

This repository does not have a README...

CVE-2025-24971

This repository does not have a README...

CVE-2022-30190_page

This repository does not have a README...

CVE-2026-68138

This repository does not have a README...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H Affects: marimo 2 calls to validateauth. terminal.py - 0 @requires, 0 validateauth. -- the flaw. The AuthBackend middleware protects HTTP and the /ws websocket, but /terminal/ws accepts the...

CVE-2023-39707

This repository does not have a README...

WordPress Redux Framework plugin <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Kuba in WordPress Plugin Redux Framework versions = 4.5.15...

WordPress WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin WP Data Access versions = 5.5.88...

CVE-2026-8237

CVE-2026-8237 CVE-2026-8237 is an Insecure Direct Object Reference IDOR vulnerability caused by missing authorization checks in Concrete CMS 9.5.0 and earlier.The flaw exists in the /ccm/frontend/conversations/messagedetail endpoint, which returns the full contents of conversation messages based...

CVE-2026-6279

This repository does not have a README...

xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Remote Code Execution Xerte Online Toolkits versions 3.15 and earlier suffer from 3 vulnerabilities in the /editor/elfinder/php/connector.php component, which may be chained together by an unauthenticated attacker to achieve Remote Code Execution RCE. Affected Version...

CVE-2021-3156

This repository does not have a README...

WordPress Popup Builder – Create highly converting, mobile friendly marketing popups. plugin <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing vulnerability

Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing vulnerability discovered by braintx in WordPress Plugin Popup Builder versions = 4.4.5...