37223 matches found
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...
ADSyncDump-BOF
ADSyncDump BOF Das ADSyncDump-BOF ist ein Port von Dirkjan Mollemas adconnectdump.py / ADSyncDecrypt in eine Beacon Object File BOF für die Verwendung mit Cobalt Strike, Sliver und Havoc. !NOTE Das Tool wurde auf einem Windows Server 2019 mit Azure AD Connect Version 2.2.1.0 getestet. Die...
f_hid-4.14-backports
Backports de fhid para Linux 4.14.190 SM-A525F Três correções para drivers/usb/gadget/function/fhid.c, aplicadas manualmente a um kernel Android de fornecedor 4.14.190 e verificadas no dispositivo em que rodam. 4.14 está em fim de vida. Não existe backport estável para nenhuma destas correções, e...
CVE-2026-81658
Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...
EUVD-2026-66996
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78276
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
cve-2026-39440-funnelforms-fix
Fix per CVE-2026-39440 FunnelForms Un plugin WordPress drop-in che blocca il gestore Demo Import vulnerabile in FunnelForms Pro ≤ 3.8.1 per mitigare l'esecuzione remota di codice CVE-2026-39440, CVSS 9.9. La vulnerabilità...
CVE-2026-4800-POC
CVE-2026-4800-POC Advisory di Sicurezza https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC root@kitploit: const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flusso...
CVE-2026-35678
Rapporto di Ricerca sulle Vulnerabilità: Insecure Direct Object Reference IDOR Universale in Eduplus Student ERP Ricercatore: Vinay Sharma 1. Sintesi Esecutiva Questo rapporto descrive una vulnerabilità di sicurezza ad alta gravità identificata nella piattaforma Eduplus Student ERP, in particolar...
CVE-2026-78292
CVE-2026-78292 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Hash Form , affecting versions
EUVD-2026-66946
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78292 WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78286
CVE-2026-78286 affects the WordPress Geo Controller plugin in versions ≤ 8.9.8 . The vulnerability is an unauthenticated PHP Object Injection , meaning an attacker can trigger it over the network without any credentials or user interaction. The CNA (Patchstack) assigned a CVSS 3.1 score of 9.8 (C...
EUVD-2026-66943
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...