CVE-2026-2688

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

EUVD-2026-70037

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688 CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2026-2688

The HIPAA FORMS WordPress plugin (by CM) prior to version 3.2.0 contains a hardcoded authentication bypass : a fixed parameter included with all AJAX requests causes the server to skip nonce validation entirely, allowing unauthenticated attackers to access protected endpoints. The vulnerability i...

CVE-2025-1306

Exploit Newscrunch CVE-2025-1306 🚨 Aperçu Cet exploit cible une vulnérabilité de type Cross-Site Request Forgery CSRF vers un téléchargement arbitraire de fichiers CVE-2025-1306 dans le thème Newscrunch WordPress. En raison de l'absence de validation de nonce dans la fonction...

CVE-2022-24611

CVE-2022-24611 Подробности об атаке Z-Wave S0-No-More. Полный анализ и отчет о том, как это работает и как воспроизвести результаты, см. в прилагаемом PDF-файле. Краткое описание: Атака типа «Отказ в обслуживании» DoS против устройств S0 и S2 протестировано на линейке продуктов Z-Wave ZW5xx, в...

CVE-2024-31497-POC

CVE-2024-31497 POC Cette vulnérabilité exploite la génération biaisée du nonce ECDSA dans le fichier ecc-ssh.c. Le nonce est généré avec $sha512ID\ ||\ sha512privKey\ ||\ sha1data\ mod\ q$ laissant les 9 bits de poids fort à zéro. Afin de récupérer la clé privée, nous avons besoin de 60 signature...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

EUVD-2026-69873

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-14982

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2025-10377

Preuve de concept CVE-2025-10377 : Cross-Site Request Forgery CSRF dans le tableau de bord du plugin System Dashboard Fonction sdtogglelogs Type de vulnérabilité : Cross-Site Request Forgery CSRF Fonction affectée : sdtogglelogs CVSS v3.1 : 4.3 Moyen Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N No...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – Подделка подписи SPHINCS+ WOTS+ из-за слабой случайности Обзор Реализация постквантовой схемы подписи SPHINCS+ использует некорректный генератор случайных чисел при генерации подписи WOTS+. Одно и то же значение nonce k повторно используется в нескольких подписях, что позволяет...

CVE-2025-11988

1 Extraire le nonce public cryptoajax root@kitploit: UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s'...

rcno-reviews

Recencio Critiques de livres Un plugin WordPress pour gérer et afficher des critiques de livres. Type de publication personnalisé, 7 taxonomies, 13 shortcodes, 7 widgets, 6 modèles, 5 extensions. Toutes les données sont stockées dans les métadonnées standard de WordPress — pas de tables...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ 管理者アカウント作成による未認証の権限昇格 ♡ === shadow ♡ & friska === 📋 脆弱性情報 項目| 詳細 ---|--- CVE ID| CVE-2026-8732 CVSS スコア| 9.8 Critical CVSS ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H タイプ| 重要な機能に対する認証の欠如 プラグイン| WP Maps Pro wp-google-map-gold 影響を受けるバージョン| すべてのバージョン ≤...

cve-2024-13176-timing-analysis

Инструментальное обнаружение низкоамплитудной утечки по времени ECDSA в CVE-2024-13176 Этот репозиторий содержит исследовательский отчёт, веб-сайт, данные, исходные материалы и файлы для воспроизводимости результатов независимого исследования CVE-2024-13176. Проект изучает, можно ли обнаружить...

EUVD-2026-68980

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2024-32444

CVE-2024-32444 Au 24/01/25, cette vulnérabilité ne dispose pas de correctif, il s'agit donc simplement d'un modèle de détection de produit, car tous les produits associés au thème wordpress RealHome sont vulnérables. Le thème permet aux utilisateurs de s'inscrire via la fonction...

BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2026-77013

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...