CVE-2026-14224

The Easy Appointments WordPress plugin versions prior to 3.12.28 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the appointment targeted by its customer-data update action belongs to the authenticated user, relying instead on a shared nonce that ...

Hardcoded credentials

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it...

Logic flaws exist in the YiYu enterprise building system vulnerability

Eyou content management system EyouCms belongs to Hainan Zanzan Network Technology Co., Ltd. is the newest PHP open source website management system. EyouCms has a logic flaw vulnerability that can be exploited by attackers to tamper with other users' information...