CVE-2026-77010 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...

CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

EUVD-2026-68054

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (through 1.0.3 ) contains a missing authorization check on one of its REST API routes . This allows unauthenticated users to retrieve the plugin's stored settings, including the shared secret used to sign API requests to the ...

CVE-2026-19430

CVE-2026-19430 affects the Catfolders Document Gallery Pro WordPress plugin (versions before 2.0.7). The root cause is missing authorization on certain REST API routes combined with a client-side forgeable token that identifies the requested content. This allows unauthenticated users to list and ...

EUVD-2026-68049

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...

CVE-2025-43990-Magento-RCE

Magento APSB25-94 — Caricamento file non autenticato a RCE Panoramica Sfrutta il caricamento di file non autenticato in Magento / Adobe Commerce tramite il caricamento di file customoptions del carrello ospite API REST. Catena d'attacco root@kitploit: 1. GraphQL → leak product SKU 2. REST API →...

PT-2026-83431

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Analisi Tecnica & Sfruttamento in Laboratorio dell'Argument Injection tramite Null-Byte Riepilogo della Vulnerabilità CVE-2022-36804 è una vulnerabilità di Argument Injection ad alta gravità/critica all'interno dell'API REST di Atlassian...

wp2shell-poc

wp2shell PoC Il primo PoC in assoluto della SQL injection basata su timing in pre-autenticazione per la catena di confusione batch-route dell'API REST di WordPress CVE-2026-63030 + CVE-2026-60137 Ottiene l'esecuzione di comandi, senza limitarsi a tentare di forzare la password dell'amministratore...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — WordPress Privilege Escalation Exploração prática de vulnerabilidade crítica no WordPress usando o plugin WooCommerce Payments. 📌 Resumo A CVE-2023-28121 permite criar usuários administradores sem autenticação via REST API. Severidade: Crítica CVSS 9.8 Impacto: Controle total d...

CVE-2025-67923

Relatório de Exploração CVE-2025-67923 JetEngine = 3.7.7 — Cross-Site Scripting Armazenado Não Autenticado via API REST CCT Data: 11 de março de 2026 Pontuação CVSS: 7.1 Alta Vetor CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Plug-in Afetado: JetEngine = 3.7.7 Slug do Plug-in: jet-engine...

POC-CVE-2026-63030-CVE-2026-60137-

PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137 -red?style=for-the-badge 📌 Panoramica Overview WP2Shell è una catena di exploit critica Exploit Chain nel codice di WordPress Core , che consente a un attaccante remoto non autenticato Unauthenticated Remote Attacker di assumere il pieno controllo d...

EUVD-2026-66713

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project...

CVE-2026-7458

🧨 CVE-2026-7458 – PickPlugins User Verification OTP-Bypass Nicht authentifizierte Authentifizierungsumgehung durch losen Vergleich in der OTP-Verifizierungs-REST-API PickPlugins User Verification ≤ 2.0.46 📖 Beschreibung Das User Verification -Plugin von PickPlugins für WordPress Versionen ≤ 2.0.4...

CVE-2026-23550

🧨 CVE-2026-23550 – Modular Connector एडमिन बाईपास बिना प्रमाणीकरण के WordPress एडमिन लॉगिन,origin=mo पैरामीटर के माध्यम से Modular Connector प्लगइन ≤ 2.5.1 📖 विवरण WordPress के लिए Modular Connector प्लगइन संस्करण ≤ 2.5.1 में एक गंभीर प्रमाणीकरण बाईपास भेद्यता है। एक बिना प्रमाणीकृत हमलावर REST A...

CVE-2026-27344

Broken Access Control nel plugin Inseri Core WordPress Plugin: Inseri Core Componente interessato: /includes/restapi.php Tipo di vulnerabilità: Broken Access Control Autorizzazione mancante Stato: Segnalato in agosto 2026– Chiuso come Duplicato. Riepilogo Durante i test di quest'estate, mi sono...

WP2Shell

WP2Shell - Exploit RCE pre-autenticazione per WordPress CVE-2026-63030 + CVE-2026-60137 Versione: 4.0.0 Autore: G0D150NE 📌 Panoramica WP2Shell è uno strumento di exploit a catena completa per l'esecuzione remota di codice pre-autenticazione su WordPress. Combina due vulnerabilità critiche:...

wp2shell-PoC

wp2shell-PoC ⚠ Questo strumento è creato esclusivamente per scopi educativi o di bug bounty. L'uso non autorizzato al di fuori di ambienti controllati è severamente vietato. Panoramica Prova di concetto per la catena di vulnerabilità wp2shell che colpisce WordPress Core, combinando CVE-2026-63030...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — PoC per SQL injection nel core di WordPress Prova di concetto non distruttiva e strumento di verifica per CVE-2026-60137 , una SQL injection cieca nel core di WordPress WPQuery::authornotin, raggiungibile tramite il parametro authorexclude dell'API REST. Causa principale...