WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data. Authorization...

CVE-2026-118418

The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...

WordPress Redirection for Contact Form 7 plugin < 3.2.16 - Unauthenticated Forged Personal Data Request Creation vulnerability

Unauthenticated Forged Personal Data Request Creation vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Redirection for Contact Form 7 versions 3.2.16...

CVE-2026-121873

The Redirection for Contact Form 7 WordPress plugin (versions before 3.2.16 ) is vulnerable to an Unauthenticated Forged Personal Data Request Creation vulnerability. The application fails to verify the ownership of an email address provided via its data request form action. Consequently, it defa...

CVE-2026-118418

The WP Directory Kit WordPress plugin, in versions prior to 1.6.3 , is vulnerable to unauthenticated data disclosure. The flaw exists because the public directory-search action fails to restrict which database models and columns are returned and does not verify authorization. This allows unauthen...

EUVD-2026-123174

The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...

CVE-2026-118418 WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure

The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

CVE-2026-118418: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public…

The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and...

CVE-2026-36374

Description A public endpoint has been identified that allows certificate lookup using a predictable identifier certificate code, without any authentication or authorization mechanism. By enumerating this identifier, an attacker can access third-party personal data, including full name, CPF...

CVE-2026-123088

The UniPAY Payment Gateway For WooCommerce WordPress plugin, versions prior to 2.4 , is vulnerable to an authorization bypass. The plugin fails to perform authorization checks when returning an order-received URL for a user-supplied order id . This flaw allows unauthenticated attackers to enumera...

CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...

CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-120328

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails...

CVE-2026-120328 Information Disclosure in extension "Mail" (mail)

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails...

EUVD-2026-115741

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails...

CVE-2026-120328

The TYPO3 extension "Mail" (mail) is affected by an Information Disclosure vulnerability (CVE-2026-120328 ) in its click tracking middleware. The root cause is a failure to validate a recipient's authentication code when that code is omitted. This allow unauthenticated attackers to retrieve perso...