237 matches found
CVE-2026-3587
creationtimestamp| type| source ---|---|--- 2026-03-23 08:02:01+00:00| seen| https://infosec.exchange/users/certvde/statuses/116277439434054031 2026-03-23 08:02:11+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mhplts73kmm2 2026-03-23 08:17:02+00:00| seen|...
Cross-site Scripting (XSS)
Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field when updating order statuses in the orders table. An attacker can execute arbitrary JavaScript code in the context of an administrator's browser by...
CVE-2026-2448
creationtimestamp| type| source ---|---|--- 2026-03-03 04:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116163361394594510 2026-03-03 04:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mg4wowxu2425 2026-03-03 07:26:23+00:00| seen|...
CVE-2026-26975
creationtimestamp| type| source ---|---|--- 2026-02-20 01:17:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfawskqi6z2f 2026-02-20 01:18:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfawti2fy32k 2026-02-20 01:30:31+00:00| seen|...
CVE-2026-25049
creationtimestamp| type| source ---|---|--- 2026-02-04 21:01:03+00:00| seen| https://threatintel.cc/2026/02/04/critical-nn-flaws-disclosed-along.html 2026-02-04 21:23:59+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116014464225155765 2026-02-04 21:27:57+00:00| seen|...
WordPress plugin Fortis for WooCommerce 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...
EUVD-2025-206485
The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handlewebhook function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending...
BIT-MOODLE-2025-3645 Moodle: idor in messaging web service allows access to some user details
A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses...
EVMAPA
RISK EVALUATION Successful exploitation of these vulnerabilities could lead to degraded service, a denial-of-service, or unauthorized remote command execution, which could lead to spoofing or a manipulation of charging station statuses. 2. RECOMMENDED PRACTICES CISA recommends users take...
CVE-2022-25731
creationtimestamp| type| source ---|---|--- 2026-01-20 08:05:00+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...
SUSE CVE-2017-18895
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information user statuses via a REST API version 4 endpoint...
PT-2026-3226
The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possibl...
CVE-2026-22643
creationtimestamp| type| source ---|---|--- 2026-01-15 14:43:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mchsz6yior2f 2026-01-15 14:43:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mchszz4er322 2026-01-15 15:12:34+00:00| seen|...
PT-2026-2818
The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm get email recipients and wpcrm system ajax task change status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers,...
CVE-2024-2110
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...
GHSA-6MQ8-RVHQ-8WGG
creationtimestamp| type| source ---|---|--- 2026-01-05 22:14:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844791950366444 2026-01-05 23:05:33+00:00| published-proof-of-concept| Telegram/SaQdu2HuKivKnxzQDHW0crSXnl1eIl3nAV9Cs1OYgaU4ueA 2026-01-06 03:55:16+00:00| seen|...
CVE-2025-14762
creationtimestamp| type| source ---|---|--- 2025-12-17 20:38:12+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736831023453482 2025-12-17 20:38:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115736831846545668 2025-12-19 12:00:58+00:00| seen|...
CVE-2025-12963
creationtimestamp| type| source ---|---|--- 2025-12-12 04:34:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/115704730410222311 2025-12-12 04:34:37+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m7rb5pqz5r2j 2025-12-12 05:25:47+00:00| seen|...