CVE-2024-12860 CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover

The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for...

CVE-2025-0796

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

CVE-2024-13684

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

CVE-2024-13684

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

CVE-2024-13677

The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details...

CVE-2024-13684 Reset <= 1.6 - Cross-Site Request Forgery to Database Reset

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

CVE-2024-13684 Reset <= 1.6 - Cross-Site Request Forgery to Database Reset

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

PT-2025-6528

Name of the Vulnerable Software and Affected Versions CarSpot – Dealership Wordpress Classified Theme versions up to 2.4.3 Description The issue concerns a privilege escalation vulnerability via account takeover. This vulnerability arises due to the plugin's failure to properly validate a token...

PT-2025-6800 · WordPress · Mortgage Lead Capture System

Name of the Vulnerable Software and Affected Versions: Mortgage Lead Capture System plugin for WordPress versions up to, and including, 8.2.10 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wprequal reset defaults action. This...

igb Component Privilege Escalation

The vulnerability of the igb component in the Linux operating system’s kernel is related to an operation that goes beyond the memory buffer boundaries within the igbvfresetmsg function. Exploiting this vulnerability can allow an attacker to gain elevated privileges within the system...

WordPress plugin Reset has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-6595

Name of the Vulnerable Software and Affected Versions Reset plugin for WordPress versions up to, and including, 1.6 Description The issue is due to missing or incorrect nonce validation on the reset db page function, making it possible for unauthenticated attackers to reset several tables in the...

CVE-2025-0796: Cross-Site Request Forgery (CSRF)

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

CVE-2024-13684: Cross-Site Request Forgery (CSRF)

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

WordPress CarSpot theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover vulnerability

Unauthenticated Arbitrary Password Reset/Account Takeover vulnerability discovered by Lucio Sá in WordPress Theme CarSpot versions = 2.4.3...

WordPress Reset plugin <= 1.6 - Cross-Site Request Forgery to Database Reset vulnerability

Cross-Site Request Forgery to Database Reset vulnerability discovered by luckybuddy in WordPress Plugin Reset versions = 1.6...

WordPress Mortgage Lead Capture System plugin <= 8.2.11 - Cross-Site Request Forgery to Settings Reset vulnerability

Cross-Site Request Forgery to Settings Reset vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Mortgage Lead Capture System versions = 8.2.11...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulner...

Google Android onCreate function authorization issue vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an authorization issue vulnerability that stems from a lack of permission checking in the onCreate function of ChooserActivity.java, which can be exploited by an attacker to cause a bypass of...

Google Android shouldSkipForInitialSUW function authorization issue vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an authorization issue vulnerability that stems from a lack of permission checking in the shouldSkipForInitialSUW function of AdvancedPowerUsageDetail.java, which can be exploited by an attacker ...