299436 matches found
CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...
EUVD-2026-96343
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-...
CVE-2026-108548
AstronRPA versions through 1.1.6 are vulnerable to an authentication bypass due to a flaw in the OpenResty gateway's auth_handler.lua component. The system fails to validate Bearer tokens , allowing unauthenticated attackers to provide arbitrary values to access the /api/resource/ and /api/rpa-ai...
CVE-2026-108161
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
EUVD-2026-96316
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
CVE-2026-108161
FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...
wpbf
wpbf! wpbf è uno strumento di brute force per testare da remoto la robustezza delle password, l'enumerazione degli utenti e il rilevamento dei plugin su un sito WordPress. Description ^^^^^^^^^^^ Lo script tenterà di accedere alla dashboard di WordPress tramite il modulo di login utilizzando una...
CVE-2026-107657
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-96301
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657
The HivePress WordPress plugin (versions ≤ 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the < parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For the vulnerability to be ex...
CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-96574
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...
CVE-2026-96574
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.3.12 . The root cause is insufficient input sanitizatio...
EUVD-2026-96225
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...
CVE-2026-96840
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.1.0 . The root cause is insufficient input sanitization and output escaping in the display_name User Field. Specifically, while WordPress core encod...
CVE-2026-96574 User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...
CVE-2026-96840 Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2026-105977
The Portfolio Filter Gallery WordPress plugin versions before 2.2.1 is vulnerable to an authorization bypass due to a lack of per-object authorization checks. Specifically, the pfg_delete_video_thumbnail function fails to verify ownership, allowing users with the Contributor role and above to per...
CVE-2026-105977 Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...