31 matches found
CVE-2026-4290
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...
EUVD-2026-33327
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...
CVE-2026-4290
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...
CVE-2026-4290 WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/userid REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission callback unconditionally returning true and the Database::delete...
CVE-2026-4290
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the REST endpoint /wp-json/wp-travel/v1/travel-guide/{user_id} in all versions up to 10.6.0. The root cause is a check_permission() callback that unconditionally returns true and a Database::delete() call that pas...
PT-2026-44859
Name of the Vulnerable Software and Affected Versions WP Travel Pro versions prior to 10.6.1 Description The plugin allows unauthenticated attackers to delete arbitrary user accounts, including administrators. This occurs via the '/wp-json/wp-travel/v1/travel-guide/user id' REST API endpoint...
EUVD-2014-6563
Malware in sbrugna...
EUVD-2025-16696
Malicious code in bioql PyPI...
CVE-2024-12876
The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible fo...
CVE-2024-12876
CVE-2024-12876 affects the Golo – City Travel Guide WordPress Theme (WordPress theme). The issue is privilege escalation via account takeover: an unauthenticated attacker can change arbitrary user passwords (including administrators) due to improper validation of user identity before password upd...
jakartatravelguide.com Cross Site Scripting vulnerability OBB-3771905
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
portugaltravelguide.com Cross Site Scripting vulnerability OBB-3705643
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
TouristEye - Travel Guide - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application TouristEye - Travel Guide published at the 'play' market has multiple vulnerabilities...
World Explorer - Travel Guide - Apache license, Dynamic Code Loading, External URLs vulnerabilities
HackApp vulnerability scanner discovered that application World Explorer - Travel Guide published at the 'play' market has multiple vulnerabilities...
Barcelona Travel Guide - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Barcelona Travel Guide published at the 'play' market has multiple vulnerabilities...
New York Travel Guide - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application New York Travel Guide published at the 'play' market has multiple vulnerabilities...
New York Pass - Travel Guide - ContentProvider mode not defined, Corrupted files, Dynamic Code Loading vulnerabilities
HackApp vulnerability scanner discovered that application New York Pass - Travel Guide published at the 'play' market has multiple vulnerabilities...
World Travel Guide by Triposo - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities
HackApp vulnerability scanner discovered that application World Travel Guide by Triposo published at the 'play' market has multiple vulnerabilities...
Berlin Travel Guide - Customized SSL, Hardcoded secrets, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application Berlin Travel Guide published at the 'play' market has multiple vulnerabilities...
Rome Travel Guide - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Rome Travel Guide published at the 'play' market has multiple vulnerabilities...