CVE-2026-8181

CVE-2026-8181 - Exploit de contournement d'authentification Burst Statistics Exploit Python 2.7 pour la vulnérabilité du plugin Burst Statistics CVE-2026-8181 qui permet à des attaquants non authentifiés de contourner l'authentification de l'API REST, de récupérer les mots de passe d'application ...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Contournement de l'authentification ⚠️ Avertissement Cet outil est destiné uniquement à la recherche en cybersécurité offensive et défensive. Veuillez l'utiliser conformément aux lois sur la cybersécurité ! Toute action illégale, telle qu'une...

CVE-2022-2414

CVE-2022-2414 CVE-2022-2414 Preuve de concept 1. Remplacez YOURHOST par votre cible comme dans l'URL ci-dessous url = "https://example.com/ca/rest/certrequests"...

BIT-PARSE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ;...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Le plugin AI Bud expose un point de terminaison REST API /wp-json/ai-buddy/v1/wp/attachments qui permet de télécharger des fichiers dans la médiathèque WordPress. La logique de fichier du point de terminaison contient une...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms Это форк безопасности SudoWP оригинального плагина Crowdsignal Forms. !WARNING Уведомление о безопасности : Оригинальный плагин "Crowdsignal Forms" версии = 1.7.2 содержит критическую уязвимость Missing Authorization CVE-2025-69015 , позволяющую аутентифицированным...

CVE-2025-11771

Exploit : Création non authentifiée d'enregistrement de vente Console du navigateur fetch'http://localhost/wordpress/wp-json/tokenico/create-sale-record', method: 'POST', headers: 'Content-Type': 'application/x-www-form-urlencoded' , body: new URLSearchParams networkId: "137", presaleKey:...

CVE-2025-12030

CVE-2025-12030 : Référence directe à un objet non sécurisée dans le plugin WordPress ACF to REST API Mots-clés : CVE-2025-12030, vulnérabilité ACF to REST API, IDOR, sécurité WordPress, exploitation authentifiée, vulnérabilité de plugin WordPress, CWE-639, modification de champs ACF, contournemen...

Rocky Linux 8 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / libslirp / etc (crlsa-2021_0531)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210531 advisory. podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API CVE-2020-14370 Tenable has extracted the preceding...

CVE-2024-37054

mlflow-pickle-rce Универсальный proof-of-concept для RCE через десериализацию pickle в реестрах моделей MLflow в стиле CVE-2024-37054. Взаимодействует только с MLflow REST API — без предположений о каком-либо конкретном клиентском приложении перед ним. ⚠️ Только для авторизованного тестирования...

CVE-2026-102134

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

CVE-2026-102134

The Kiteworks Core platform contains a vulnerability where gateway-level API security controls are not consistently applied to all requests authenticated via the central authentication service. Specifically, an authenticated user can access REST API functionality through request paths that bypass...

CVE-2026-102134 Kiteworks Core Unprotected Alternate Channel

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

wp-secure-mcp

wp-secure-mcp Простыми словами: это позволяет ИИ-агенту читать и немного записывать данные на сайт WordPress через настоящий Application Password WordPress — тот же тип учётных данных, который уже выдаёт wp-admin — и ничего больше. Здесь нет формы регистрации, нет регистрации OAuth-клиента, нет...