Lucene search
+L

10167 matches found

CVE
CVE
added 2026/09/16 8:32 p.m.13 views

CVE-2026-92806

phpList versions before 3.6.17 are vulnerable to Cross-Site Request Forgery (CSRF) in the mass subscriber removal form handler (massremove.php). The root cause is the absence of CSRF token validation, allowing an attacker to craft a page that, when visited by a logged-in administrator, triggers s...

8.1CVSS0.00166EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/16 8:32 p.m.29 views

CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

8.1CVSS0.00166EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/16 8:32 p.m.8 views

EUVD-2026-81066

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

8.1CVSS0.00166EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/16 8:32 p.m.3 views

CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

7.2CVSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/16 4:45 p.m.11 views

CVE-2025-14172-Nuclei-Template

📄 CVE-2025-14172 用 Nuclei テンプレート 🚀 概要 このリポジトリは、WordPress プラグイン WP Page Permalink Extension における Missing Authorization Vulnerability(CVE-2025-14172) を検出するために特別に設計された Nuclei テンプレートを提供します。この問題により、認証済みの攻撃者が脆弱な AJAX アクションを介してサイトのリライトルールをリモートでフラッシュすることが可能になります。 🔍 脆弱性の説明 CVE-2025-14172 は、WordPress 用プラグイ...

6.5CVSS5.9AI score0.00414EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 11:58 a.m.11 views

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Отсутствие проверки прав доступа для установки/активации произвольных плагинов требуется подписчик+ Описание Плагин 10Web AI Assistant – AI content writing assistant для WordPress уязвим к несанкционированному изменению...

8.8CVSS8.3AI score0.01354EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 11:58 a.m.8 views

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - SQL-инъекция через Subscriber+ Необходимо установленный sqlmap и действительные имя пользователя и пароль с ролью Subscriber+ Использование root@kitploit: usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show...

8.8CVSS8.2AI score0.05141EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/16 11:57 a.m.10 views

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Некорректный контроль доступа к AJAX-вызовам Subscriber+ Описание: Некоторые AJAX-вызовы плагина не проверяют должным образом права доступа и CSRF-токены, что приводит к таким проблемам, как чтение произвольных записей, экспорт списка...

9.3CVSS8.5AI score0.02269EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 11:41 a.m.10 views

CVE-2024-1247-PoC

CVE-2024-1247-PoC Плагин Post Saint = 1.3.1 для WordPress — произвольная загрузка файлов Описание Плагин Post Saint для WordPress версии до 1.3.1 включительно уязвим для произвольной загрузки файлов из-за отсутствия проверки прав доступа и валидации типов файлов. Аутентифицированные злоумышленник...

8.8CVSS6.6AI score0.01516EPSS
SaveExploits1
NVD
NVD
added 2026/09/16 6:16 a.m.8 views

CVE-2026-87959

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

5.4CVSS0.00181EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/16 6:16 a.m.7 views

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

5.7CVSS0.00242EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/16 6:00 a.m.8 views

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

5.7AI score0.00181EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/16 6:00 a.m.14 views

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2–8.7.5 ) contains a missing capability check on the AJAX action that saves its Claude AI provider settings . This allows users with subscriber-level access to overwrite those settings, including the API key used for the plugin's outgoing AI requests, as d...

5.4CVSS5.7AI score0.00181EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/16 6:00 a.m.6 views

WordPress WPBot plugin 8.7.2-8.7.5 - Subscriber+ Claude AI Settings Update vulnerability

Subscriber+ Claude AI Settings Update vulnerability discovered by Sergey Mkrtchyan b1acksparrow in WordPress Plugin ChatBot versions 8.7.2-8.7.5...

5.4CVSS0.00181EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/09/16 6:00 a.m.10 views

CVE-2026-87828

Seraphinite Accelerator is a WordPress plugin that, in versions before 2.29.24 , fails to perform a capability check on its seraph_accel_State Update AJAX action. An authenticated user with at least Subscriber level can write a malformed value through this action, triggering an uncaught error on ...

5.7CVSS5.7AI score0.00242EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/16 6:00 a.m.9 views

EUVD-2026-80195

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

5.8AI score0.00282EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/16 6:00 a.m.10 views

CVE-2026-85572

Tutor LMS WordPress plugin versions 4.0.0 through 4.0.7 fail to verify that a user has access to a course before returning its lesson discussion content . This allows any authenticated user—even a subscriber role—to read comments from courses they are not enrolled in, including comments awaiting ...

4.3CVSS5.7AI score0.00282EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/16 6:00 a.m.28 views

CVE-2026-85349 FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...

0.00282EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/16 6:00 a.m.27 views

CVE-2026-85572 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

0.00282EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/16 6:00 a.m.6 views

WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

4.3CVSS0.00282EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder