Lucene search
+L

20351 matches found

EUVD
EUVD
added 1 hour ago6 views

EUVD-2026-52263

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References2
NVD
NVD
added 3 hours ago8 views

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS
SaveExploits0References1
Cvelist
Cvelist
added 5 hours ago7 views

CVE-2026-2346 IDOR in Menulux Software's Mobile App

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS
SaveExploits0References1
CVE
CVE
added 5 hours ago6 views

CVE-2026-2346

CVE-2026-2346 affects Menulux Software’s Mobile App up to version 12.05.2026, with an IDOR authorization bypass via a user-controlled key. The CVSS v3.1 score is 9.8 (CRITICAL), from vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack with no privileges required and no ...

9.8CVSS5.4AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 5 hours ago4 views

CVE-2026-2346 IDOR in Menulux Software's Mobile App

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 5 hours ago2 views

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References2
Nuclei
Nuclei
added 12 hours ago32 views

WP Mobile Detector <= 3.5 - Unrestricted File Upload

WP Mobile Detector plugin for WordPress = 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution. id: CVE-2016-15043 info: name: WP Mobile...

9.8CVSS5.9AI score0.10032EPSS
SaveExploits1References3
Nuclei
Nuclei
added 12 hours ago41 views

WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass

Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users. id: CVE-2024-50477 info: name: WordPress Stacks Mobile App Builder =5.2.3 - Authentication Bypass...

9.8CVSS5.6AI score0.07959EPSS
SaveExploits3References4
Nuclei
Nuclei
added 12 hours ago20 views

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

9.8CVSS5.4AI score0.02948EPSS
SaveExploits1References2
Nuclei
Nuclei
added 12 hours ago62 views

Sophos Mobile managed on-premises - XML External Entity Injection

An XML External Entity XXE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. id: CVE-2022-3980 info: name: Sophos Mobile managed on-premises - XML External Entity Injection author: dabla...

9.8CVSS8.2AI score0.08087EPSS
SaveExploits0References3
Nuclei
Nuclei
added 12 hours ago19 views

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

7.5CVSS5.6AI score0.02101EPSS
SaveExploits0References3
Nuclei
Nuclei
added 12 hours ago20 views

Ozette Plugins - Cross-Site Request Forgery

An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...

8.8CVSS7.5AI score0.0161EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 16 hours ago4 views

PT-2026-67390

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

9.8CVSS5.4AI score
SaveExploits0References2
NVD
NVD
added yesterday8 views

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

0.00149EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday22 views

CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

0.00149EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago7 views

CVE-2026-14561

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

5.7AI score0.00136EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago9 views

CVE-2026-14561

The Authora WordPress plugin (before version 1.7.7) fails to keep its one‑time login code confidential, exposing both the code and a valid verification token in the response of an unauthenticated action. This enables unauthenticated attackers to log in as any user whose registered mobile number i...

5.7AI score0.00136EPSS
SaveExploits0References1
SUSE CVE
SUSE CVE
added 3 days ago5 views

SUSE CVE-2026-17703

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: High...

6.5CVSS5.5AI score0.00391EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 3 days ago5 views

SUSE CVE-2026-17762

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

4.3CVSS5.5AI score0.00146EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 4 days ago5 views

CVE-2026-17860

An insufficient validation of untrusted input flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520407381...

4.4CVSS5.8AI score0.00076EPSS
SaveExploits0References5
Rows per page
Query Builder