268048 matches found
WordPress Loja Automática plugin <= 1.0.0 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Loja Automática versions = 1.0.0...
WordPress Site Setup Wizard plugin <= 1.5.8 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Site Setup Wizard versions = 1.5.8...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...
Exploit for CVE-2026-85097
CVE-2026-85097 - Bricksforge Word...
CVE-2026-109321
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321
The grav-plugin-login-oauth plugin (versions before 1.4.3 ) contains a predictable local credentials vulnerability. The flaw stems from the plugin provisioning OAuth accounts as standard Grav users using a deterministic username format (. ) and an unsalted MD5 hash of the provider identifier as t...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
EUVD-2026-97623
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
EUVD-2026-97622
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
CVE-2026-109320
The Grav API plugin (grav-plugin-api) version before 1.0.36 is vulnerable to an improper session validation flaw. The root cause is that the SessionAuthenticator fails to enforce account state, allowing users with disabled accounts to maintain API access. Attackers or unauthorized users can reuse...
CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
CVE-2026-109320
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109317
The Grav grav-plugin-api before version 1.0.36 is vulnerable to a privilege escalation flaw. The root cause is the storage of positive scalar admin or api parent grants, which allows delegated user managers to bypass security checks. An attacker with api.users.write permissions can modify account...