26218 matches found
EUVD-2026-69854
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
EUVD-2026-69853
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability
Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81426
The WC Vendors WordPress plugin, in versions prior to 2.7.2.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF protection on specific front-end order shipment status actions. This flaw could allow an attacker to force a logged-in vendor to modify the...
CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
EUVD-2026-69850
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
CVE-2026-69664
creationtimestamp| type| source ---|---|--- 2026-09-02 05:18:17+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117199752202887468 2026-09-02 12:45:29+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-erlang/otp-3...
firmwalker
firmwalker A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .cr...
CVE-2026-84307
creationtimestamp| type| source ---|---|--- 2026-09-02 01:32:29+00:00| seen| https://gist.github.com/alon710/c47c604ce50ae0fa194515af5d7d206b...
CVE-2026-84327
creationtimestamp| type| source ---|---|--- 2026-09-02 00:12:56+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117198551537914778 2026-09-02 04:46:35+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260902 2026-09-04 04:45:51+00:00| seen|...
PT-2026-84633
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
PT-2026-84982
Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.41.6 util-linux version 2.42.2 Description The software fails to verify the exit status of mount helpers before executing post-mount hooks. This allows unprivileged users to perform privileged operations on...
PT-2026-84751
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
CVE-2026-81426: Cross-Site Request Forgery (CSRF)
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
PT-2026-84634
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81427: Missing Authorization
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...