CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects من BetterLinks - 2.0.0 – 2.0.3 - مشترك + تثبيت إضافي عشوائي وصف نقص في فحوصات الصلاحية وفحص غير كافٍ لـ nonce في إجراء AJAX داخل الإضافة جعل من الممكن للمستخدمين المصادق عليهم تثبيت إضافات عشوائية على المواقع الضعيفة. كيفية الاستخدام $ python3 CVE-2021-24356.py...

CVE-2025-2539

CVE-2025-2539 - WordPress File Away = 3.9.9.0.1 - قراءة ملفات تعسفية 🔥 ملخص الثغرة إضافة ووردبريس File Away بإصدار = 3.9.9.0.1 معرّضة لثغرة قراءة ملفات تعسفية دون مصادقة. وهذا يتيح للمهاجمين قراءة أي ملف على الخادم، مثل wp-config.php، عبر طلب مخصص لنقطة نهاية AJAX الخاصة بالإضافة. تنبع الثغرة من...

CVE-2025-1306

Exploit Newscrunch CVE-2025-1306 🚨 Aperçu Cet exploit cible une vulnérabilité de type Cross-Site Request Forgery CSRF vers un téléchargement arbitraire de fichiers CVE-2025-1306 dans le thème Newscrunch WordPress. En raison de l'absence de validation de nonce dans la fonction...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF إلى الكتابة التعسفية على الملفات في إضافة Optimole لووردبريس ملخص ثغرة تزوير الطلب عبر الموقع CSRF في إضافة Optimole لووردبريس الإصدارات = 4.2.5 تسمح للمهاجمين غير المصادقين بالكتابة بصمت فوق أصول مكتبة الوسائط الموجودة من خلال إجراء AJAX wpajaxoptmlreplacefile بسبب عدم وجود...

CVE-2024-32444

CVE-2024-32444 По состоянию на 24/01/25 эта уязвимость не имеет патча, поэтому это просто шаблон обнаружения продукта, поскольку все продукты, связанные с темой RealHome WordPress, уязвимы. Тема позволяет пользователям регистрировать новые учетные записи через функцию inspiryajaxregister, однако...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

EUVD-2026-83674

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410

The Sign-up Sheets WordPress plugin, in versions before 2.4.0 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is the insufficient validation of the CSRF nonce protecting the sign-up deletion action. An attacker can exploit this by sending a forged request to delete s...

CVE-2026-93394

libmongoc (MongoDB C driver) contains a flaw in its SCRAM authentication implementation where the client continues the handshake and transmits the client proof even after detecting a nonce mismatch in the server's first message. An attacker with a man-in-the-middle position can inject a crafted s...

CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin (versions before 5.1.1 ) contains a vulnerability where the message deletion AJAX action fails to verify user capabilities. Instead of validating the nonce parameter, the plugin only checks for its presence. ...

EUVD-2026-81353

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated remote attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens , since there is no nonce valida...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

EUVD-2026-74853

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...