WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

CVE-2025-69581

CVE-2025-69581 Chamillo LMS 1.11.2 において問題が発見されました。Social Network /personaldata エンドポイントは、適切なキャッシュ制御が欠如しているため、ログアウト後も機密性の高いユーザー情報をそのまま公開します。ブラウザの「戻る」ボタンを使用すると、すべての個人データが復元され、同じデバイス上の権限のないユーザーが機密情報を閲覧できるようになります。これにより、プロファイリング、なりすまし、標的型攻撃、および重大なプライバシーリスクが生じます。発見者：Rivek Raj Tamang RivuDon、インド・シッキム州。...

CVE-2026-36374

설명 예측 가능한 식별자인증서 코드를 사용하여 인증 또는 권한 부여 메커니즘 없이 인증서 조회를 허용하는 공개 엔드포인트가 확인되었습니다. 이 식별자를 열거함으로써 공격자는 전체 이름, CPF브라질 개인 납세자 등록 번호, RG브라질 신분증 번호, 생년월일, 출생지 등 제3자의 개인 데이터에 접근할 수 있습니다. 또한 인증서 보유자가 부분적으로 난독화된 개인 데이터가 포함된 졸업장을 공개적으로 공유하는 경우예: 전문 네트워크 또는 기타 플랫폼에도 인증서 식별자가 종종 그대로 노출되는 것이 관찰됩니다. 이 식별자를 통해 엔드포인...

EUVD-2026-73766

Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API 평가 PoC 이 저장소는 보고된 인증되지 않은 BookingPress Pro REST API 노출을 검증하기 위한 Python 개념 증명PoC을 포함합니다. 성공적인 응답에는 예약 및 고객 정보가 포함될 수 있으며, 이 정보에는 개인 데이터가 포함될 수 있습니다. 승인 필요 이 프로젝트는 본인이 소유하거나 명시적으로 평가 승인을 받은 시스템에만 사용하십시오. 서면 허가 없이 공용, 제3자 또는 운영프로덕션 시스템에 대해 실행하지 마십시오. 검색된 모든 예약 데이터는...

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows i...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

EUVD-2026-63359

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

EUVD-2026-62628

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-17087

The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...

Exploit for CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This reposi...

CVE-2026-14213

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-14213

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

EUVD-2026-57727

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

EUVD-2026-57081

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14925 Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...