NPM: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

NPM: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

wp-user-registration-vuln-checker

Comprobador de User Registration de WordPress para CVE-2026-1492 Comprobador de solo lectura para sitios de WordPress propios que pueden estar afectados por CVE-2026-1492 en el plugin User Registration & Membership. Ayuda al propietario del sitio a confirmar la exposición del plugin y a buscar...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Escalada de Privilegios sin Autenticación Autor: Hyun Chiya Información de la Vulnerabilidad Campo| Valor ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Versiones Afectadas| B"Extract Nonce acfnonce & Form ID acfform" B --...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin versions 1.1.0 through 1.1.2 fails to validate the tgwcfb_id parameter during registration, reading the permitted-role allow-list from an arbitrary attacker-controlled post rather than a legitimate registration form. A user with Contributor o...

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-1492

CVE-2026-1492 - Exploit de escalada de privilegios en el plugin de registro de usuarios de WordPress Descripción Este repositorio contiene un exploit de prueba de concepto para CVE-2026-1492 , una vulnerabilidad crítica que afecta al plugin de WordPress User Registration & Membership. La...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

Herramienta de Explotación CVE-2026-1529 para Keycloak Keycloak: Registro no autorizado de organizaciones mediante validación incorrecta de tokens de invitación Aviso Legal Esta herramienta es solo para fines educativos y de pruebas de seguridad. Úsela únicamente en sistemas para los que tenga...

CVE-2026-7401-XSS

XSS Almacenado en CET Automated Grading System — Registro de Estudiantes Sin Autenticación → Panel de Administración Detalles...

CVE-2026-1529

Herramienta de Explotación CVE-2026-1529 Keycloak CVE-2026-1529 : Keycloak - Registro de organización no autorizado mediante validación incorrecta del token de invitación ⚠️ ADVERTENCIA : Esta herramienta es solo para fines educativos y de pruebas de seguridad autorizadas. El acceso no autorizado ...

PT-2026-89294

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

CVE-2026-54694

CVE-2026-54694 affects SkillTree (NationalSecurityAgency/skills-service), a micro-learning gamification platform, in versions prior to 4.4.2 . Two flaws chain into a Stored XSS that enables admin account takeover : StringHighlighter.js interpolates unencoded user input into HTML rendered via v-ht...

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

EUVD-2026-75116

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...