65 matches found
Magneto-PolyShell
استغلال RCE في Magento 2 - رفع ملف بدون مصادقة إلى RCE ⚠️ هذه الأداة مخصصة للاختبار الأمني التعليمي والمصرح به فقط. الاستخدام غير المصرح به ضد أنظمة لا تملكها غير قانوني. يستهدف هذا الاستغلال ثغرة حرجة في تنفيذ التعليمات البرمجية عن بُعد RCE غير المصادق عليها في Magento 2 Adobe Commerce. من خلال...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
EUVD-2026-60937
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181
Extra Product Options & Add-Ons for WooCommerce plugin versions below 7.6 allow unauthenticated attackers to download arbitrary files, exposing sensitive data with CVSS 7.5 (HIGH). PatchStack reports the flaw; no exploit code is provided. Upgrade to version 7.6 or later to remediate. Exploitation...
CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-19728
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
CVE-2026-19728
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 exposes customer-uploaded files via the getpublicfileupload endpoint without authorization checks, allowing unauthenticated users who know a file's stored name to retrieve it. Impact is limited on nginx (where files...
CVE-2026-19728 Extra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
EUVD-2026-59920
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
CVE-2026-19728
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...
CVE-2026-57390 WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability
Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extra Product Options Builder for WooCommerce: from n/a through =...
CVE-2026-57390
The CVE concerns the WordPress plugin “Extra Product Options Builder for WooCommerce” (also listed as additional-product-fields-for-woocommerce). A Missing Authorization/Broken Access Control vulnerability affects the plugin in versions up to and including 1.2.167, enabling exploitation due to in...
WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.167...
CVE-2026-49061
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce = 3.2.1 versions...
EUVD-2026-36870
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce = 3.2.1 versions...
CVE-2026-49061 WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce = 3.2.1 versions...
CVE-2026-49061 WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce = 3.2.1 versions...