CVE-2026-13425: Improper Neutralization of Input During Web Page Generation

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

XWiki Platform - Unauthorized Document History Access Detection

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

Apereo CAS Cross-Site Scripting Detection

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Apereo CAS through 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Exploit for CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeo...

ADOKit v1.4.2

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...

CVE-2026-13390

The Events Calendar WordPress plugin (versions before 6.16.5.1 ) is vulnerable to an unauthenticated status manipulation flaw. The root cause is a missing authorization check on one of its Event Aggregator import REST API routes , combined with a skipped integrity check for a specific status valu...

PT-2026-64905

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

CVE-2026-9830: Improper Authentication

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-13390: Missing Authorization

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

wp2shell

wp2shell-poc Independent proof-of-concept for the unauthentic...

CVE-2026-17048: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

PT-2026-67606

Summary The REST API user-update endpoint PUT/PATCH /api/v2/users/id and the V1 equivalent does not enforce two authorization rules that the web interface enforces. A user who holds the user edit others permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2...

Apache Syncope permission granting and access control issues

Apache Syncope is an open-source identity management and governance system that primarily provides features for user management, permission control, and role assignment. Apache Syncope has a security vulnerability that arises from the improper validation of authorization for users who register or...

CVE-2026-16078

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...

CVE-2026-16078 WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...

CVE-2026-12082

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...

CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

CVE-2026-7534 SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

CVE-2026-7534: Improper Neutralization of Input During Web Page Generation

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

PT-2026-63573

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...