Lucene search
+L

1211042 matches found

Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.1 views

CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.0 views

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.0 views

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.1 views

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.1 views

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.0 views

CVE-2026-77016 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 6:00 a.m.1 views

CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.0 views

CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.0 views

CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 5:43 a.m.0 views

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

5.3CVSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 5:43 a.m.0 views

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

5.3CVSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 4:45 a.m.1 views

CVE-2026-68955

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

SaveExploits0
NVD
NVD
added 2026/08/27 4:17 a.m.4 views

CVE-2026-81491

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

7.5CVSS
SaveExploits0References5
CVE
CVE
added 2026/08/27 4:00 a.m.5 views

CVE-2024-380639

The provided documents indicate CVE-2024-380639 is still a reserved candidate with no publicly disclosed technical details. A single sighting on a Telegram channel confirms awareness, but no affected product, root cause, or impact is specified. Monitor for updates as details are expected when the...

SaveExploits0References1
Kitploit
Kitploit
added 2026/08/27 3:42 a.m.4 views

awesome-hacker-search-engines

Impresionantes motores de búsqueda para hackers Una lista curada de impresionantes motores de búsqueda útiles durante pruebas de penetración, evaluaciones de vulnerabilidades, operaciones de Red/Blue Team, Bug Bounty y más General • Servidores • Vulnerabilidades • Exploits • Superficie de ataque ...

5.4AI score
SaveExploits0References12
Rows per page
Query Builder