32658 matches found
CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...
CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...
CVE-2026-15941
The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...
Malicious code in boardwalk-js-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924 package.json declares preinstall: node index.js. On npm install, index.js collects the installer's hostname, username, homedir, DNS server list, and...
MAL-2026-12044 Malicious code in specials-mvno-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts...
MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...
Exploit for SQL Injection in Wordpress
CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...
CVE-2025-63823
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...
CVE-2026-15360: Improper Neutralization of Special Elements used in an SQL Command
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...
📄 LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
CVE-2025-70962
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...
CVE-2026-11920: Improper Neutralization of Special Elements used in an SQL Command
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2025-63823
The My Safetipin Android Application 5.2.1 is affected by CVE-2025-63823 , which involves hardcoded credentials within the authentication module. This flaw allows remote attackers to bypass authentication and gain unauthorized access to user accounts by leveraging predictable OTP values . No spec...
Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider
webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...
CVE-2026-15941: Improper Neutralization of Special Elements used in an SQL Command
The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...
CVE-2025-63823
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...
CVE-2017-20242
creationtimestamp| type| source ---|---|--- 2026-08-04 19:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpybpcej2z...
pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER
A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...