Lucene search
+L

10167 matches found

CVE
CVE
โ€ขadded 2026/09/16 8:32 p.m.โ€ข13 views

CVE-2026-92806

phpList versions before 3.6.17 are vulnerable to Cross-Site Request Forgery (CSRF) in the mass subscriber removal form handler (massremove.php). The root cause is the absence of CSRF token validation, allowing an attacker to craft a page that, when visited by a logged-in administrator, triggers s...

8.1CVSS0.00166EPSS
SaveExploits0References5
Cvelist
Cvelist
โ€ขadded 2026/09/16 8:32 p.m.โ€ข29 views

CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

8.1CVSS0.00166EPSS
SaveExploits0References5
EUVD
EUVD
โ€ขadded 2026/09/16 8:32 p.m.โ€ข8 views

EUVD-2026-81066

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

8.1CVSS0.00166EPSS
SaveExploits0References5
OSV
OSV
โ€ขadded 2026/09/16 8:32 p.m.โ€ข3 views

CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

7.2CVSS
SaveExploits0References7
Kitploit
Kitploit
โ€ขadded 2026/09/16 4:45 p.m.โ€ข11 views

CVE-2025-14172-Nuclei-Template

๐Ÿ“„ CVE-2025-14172 ็”จ Nuclei ใƒ†ใƒณใƒ—ใƒฌใƒผใƒˆ ๐Ÿš€ ๆฆ‚่ฆ ใ“ใฎใƒชใƒใ‚ธใƒˆใƒชใฏใ€WordPress ใƒ—ใƒฉใ‚ฐใ‚คใƒณ WP Page Permalink Extension ใซใŠใ‘ใ‚‹ Missing Authorization Vulnerability๏ผˆCVE-2025-14172๏ผ‰ ใ‚’ๆคœๅ‡บใ™ใ‚‹ใŸใ‚ใซ็‰นๅˆฅใซ่จญ่จˆใ•ใ‚ŒใŸ Nuclei ใƒ†ใƒณใƒ—ใƒฌใƒผใƒˆใ‚’ๆไพ›ใ—ใพใ™ใ€‚ใ“ใฎๅ•้กŒใซใ‚ˆใ‚Šใ€่ช่จผๆธˆใฟใฎๆ”ปๆ’ƒ่€…ใŒ่„†ๅผฑใช AJAX ใ‚ขใ‚ฏใ‚ทใƒงใƒณใ‚’ไป‹ใ—ใฆใ‚ตใ‚คใƒˆใฎใƒชใƒฉใ‚คใƒˆใƒซใƒผใƒซใ‚’ใƒชใƒขใƒผใƒˆใงใƒ•ใƒฉใƒƒใ‚ทใƒฅใ™ใ‚‹ใ“ใจใŒๅฏ่ƒฝใซใชใ‚Šใพใ™ใ€‚ ๐Ÿ” ่„†ๅผฑๆ€งใฎ่ชฌๆ˜Ž CVE-2025-14172 ใฏใ€WordPress ็”จใƒ—ใƒฉใ‚ฐใ‚ค...

6.5CVSS5.9AI score0.00414EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/16 11:58 a.m.โ€ข11 views

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant โ€“ AI ์ฝ˜ํ…์ธ  ์ž‘์„ฑ ๋„์šฐ๋ฏธ = 1.0.18 - ์ธ์ฆ๋œ ์‚ฌ์šฉ์žSubscriber+์— ์˜ํ•œ ์ž„์˜ ํ”Œ๋Ÿฌ๊ทธ์ธ ์„ค์น˜/ํ™œ์„ฑํ™” ๊ถŒํ•œ ๋ˆ„๋ฝ ์„ค๋ช… ์„ค๋ช… WordPress์šฉ 10Web AI Assistant โ€“ AI ์ฝ˜ํ…์ธ  ์ž‘์„ฑ ๋„์šฐ๋ฏธ ํ”Œ๋Ÿฌ๊ทธ์ธ์€ 1.0.18 ์ดํ•˜์˜ ๋ชจ๋“  ๋ฒ„์ „์—์„œ installplugin AJAX ์•ก์…˜์— ๋Œ€ํ•œ ๊ธฐ๋Šฅ ๊ฒ€์‚ฌ ๋ˆ„๋ฝ์œผ๋กœ ์ธํ•ด ๋ฐ์ดํ„ฐ ๋ฌด๋‹จ ์ˆ˜์ •์— ์ทจ์•ฝํ•ฉ๋‹ˆ๋‹ค. ์ด๋กœ ์ธํ•ด ๊ตฌ๋…์ž ์ˆ˜์ค€ ์ด์ƒ์˜ ์ธ์ฆ๋œ ๊ณต๊ฒฉ์ž๊ฐ€ ์ž„์˜์˜ ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์„ค์น˜ํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ด๋ฅผ ํ†ตํ•ด ์†์ƒ๋œ...

8.8CVSS8.3AI score0.01354EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/16 11:58 a.m.โ€ข8 views

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - Subscriber+ SQLใ‚คใƒณใ‚ธใ‚งใ‚ฏใ‚ทใƒงใƒณ ๅฟ…้ ˆ่ฆไปถ sqlmapใŒใ‚คใƒณใ‚นใƒˆใƒผใƒซใ•ใ‚Œใฆใ„ใ‚‹ใ“ใจใ€ใŠใ‚ˆใณsubscriber+ๆจฉ้™ใ‚’ๆŒใคๆœ‰ๅŠนใชใƒฆใƒผใ‚ถใƒผๅใจใƒ‘ใ‚นใƒฏใƒผใƒ‰ ไฝฟ็”จๆ–นๆณ• root@kitploit: usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w URL, --url URL URL of...

8.8CVSS8.2AI score0.05141EPSS
SaveExploits3
Kitploit
Kitploit
โ€ขadded 2026/09/16 11:57 a.m.โ€ข10 views

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - AJAX ํ˜ธ์ถœ์— ๋Œ€ํ•œ ๋ถ€์ ์ ˆํ•œ ์ ‘๊ทผ ์ œ์–ด Subscriber+ ์„ค๋ช…: ํ”Œ๋Ÿฌ๊ทธ์ธ์˜ ์ผ๋ถ€ AJAX ํ˜ธ์ถœ์€ ๊ถŒํ•œ ๋ฐ CSRF ํ† ํฐ์„ ์ œ๋Œ€๋กœ ํ™•์ธํ•˜์ง€ ์•Š์•„, ์ž„์˜ ๊ฒŒ์‹œ๋ฌผ ์ฝ๊ธฐ, ๊ตฌ๋…์ž ๋ชฉ๋ก ๋‚ด๋ณด๋‚ด๊ธฐ, ํ”Œ๋Ÿฌ๊ทธ์ธ ๋น„ํ™œ์„ฑํ™”์™€ ๊ฐ™์€ ๋ฌธ์ œ๊ฐ€ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. root@kitploit: reference: -...

9.3CVSS8.5AI score0.02269EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/16 11:41 a.m.โ€ข10 views

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint = 1.3.1 WordPress ํ”Œ๋Ÿฌ๊ทธ์ธ ์ž„์˜ ํŒŒ์ผ ์—…๋กœ๋“œ ์„ค๋ช… Post Saint WordPress ํ”Œ๋Ÿฌ๊ทธ์ธ1.3.1 ์ดํ•˜ ๋ฒ„์ „์€ ๋ˆ„๋ฝ๋œ ๊ถŒํ•œ ํ™•์ธ ๋ฐ ํŒŒ์ผ ํ˜•์‹ ๊ฒ€์ฆ์œผ๋กœ ์ธํ•ด ์ž„์˜ ํŒŒ์ผ ์—…๋กœ๋“œ์— ์ทจ์•ฝํ•ฉ๋‹ˆ๋‹ค. ์ตœ์†Œ ๊ตฌ๋…์ž ์ˆ˜์ค€์˜ ์ ‘๊ทผ ๊ถŒํ•œ์„ ๊ฐ€์ง„ ์ธ์ฆ๋œ ๊ณต๊ฒฉ์ž๋Š” ์ด ์ทจ์•ฝ์ ์„ ์•…์šฉํ•˜์—ฌ ์ž„์˜ ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ž ์žฌ์ ์œผ๋กœ ์›๊ฒฉ ์ฝ”๋“œ ์‹คํ–‰์œผ๋กœ ์ด์–ด์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ธฐ๋Šฅ ์ทจ์•ฝํ•œ ํ”Œ๋Ÿฌ๊ทธ์ธ ๋ฒ„์ „์„ ํƒ์ง€ํ•ฉ๋‹ˆ๋‹ค. ์ œ๊ณต๋œ ์ž๊ฒฉ ์ฆ๋ช…์„ ์‚ฌ์šฉํ•˜์—ฌ WordPress์— ๋กœ๊ทธ์ธํ•ฉ๋‹ˆ๋‹ค. ์ทจ์•ฝ...

8.8CVSS6.6AI score0.01516EPSS
SaveExploits1
NVD
NVD
โ€ขadded 2026/09/16 6:16 a.m.โ€ข8 views

CVE-2026-87959

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

5.4CVSS0.00181EPSS
SaveExploits0References1
NVD
NVD
โ€ขadded 2026/09/16 6:16 a.m.โ€ข7 views

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

5.7CVSS0.00242EPSS
SaveExploits0References1
EUVD
EUVD
โ€ขadded 2026/09/16 6:00 a.m.โ€ข8 views

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

5.7AI score0.00181EPSS
SaveExploits0References1
CVE
CVE
โ€ขadded 2026/09/16 6:00 a.m.โ€ข13 views

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2โ€“8.7.5 ) contains a missing capability check on the AJAX action that saves its Claude AI provider settings . This allows users with subscriber-level access to overwrite those settings, including the API key used for the plugin's outgoing AI requests, as d...

5.4CVSS5.7AI score0.00181EPSS
SaveExploits0References1
Patchstack
Patchstack
โ€ขadded 2026/09/16 6:00 a.m.โ€ข6 views

WordPress WPBot plugin 8.7.2-8.7.5 - Subscriber+ Claude AI Settings Update vulnerability

Subscriber+ Claude AI Settings Update vulnerability discovered by Sergey Mkrtchyan b1acksparrow in WordPress Plugin ChatBot versions 8.7.2-8.7.5...

5.4CVSS0.00181EPSS
SaveExploits0References1Affected Software1
CVE
CVE
โ€ขadded 2026/09/16 6:00 a.m.โ€ข10 views

CVE-2026-87828

Seraphinite Accelerator is a WordPress plugin that, in versions before 2.29.24 , fails to perform a capability check on its seraph_accel_State Update AJAX action. An authenticated user with at least Subscriber level can write a malformed value through this action, triggering an uncaught error on ...

5.7CVSS5.7AI score0.00242EPSS
SaveExploits0References1
EUVD
EUVD
โ€ขadded 2026/09/16 6:00 a.m.โ€ข9 views

EUVD-2026-80195

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

5.8AI score0.00282EPSS
SaveExploits0References1
CVE
CVE
โ€ขadded 2026/09/16 6:00 a.m.โ€ข9 views

CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated userโ€”even a subscriber roleโ€”to read comments from courses they are not enrolled in, including comments awaiting ...

4.3CVSS5.7AI score0.00282EPSS
SaveExploits0References1
Cvelist
Cvelist
โ€ขadded 2026/09/16 6:00 a.m.โ€ข26 views

CVE-2026-85572 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

0.00282EPSS
SaveExploits0References1
Cvelist
Cvelist
โ€ขadded 2026/09/16 6:00 a.m.โ€ข28 views

CVE-2026-85349 FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

0.00282EPSS
SaveExploits0References1
Patchstack
Patchstack
โ€ขadded 2026/09/16 6:00 a.m.โ€ข6 views

WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

4.3CVSS0.00282EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder