php-app-race-condition

Aplicación PHP Vulnerable Condición de Carrera Configuración del entorno: docker-compose up Verificación del entorno: Prueba de conexión: http://localhost/test.php Endpoint vulnerable: http://localhost/poc.php Explotación de la condición de carrera: echo http://localhost | nuclei -t race.yml...

PT-2026-83425

CVE-2026-18823 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-18823 Published : Aug. 26, 2026, 11:17 p.m. | 22 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more...

WordPress Dokan plugin < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability

Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Dokan versions 5.0.14...

PT-2026-81079

CVE-2026-5723 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-5723 Published : Aug. 23, 2026, 12:16 a.m. | 2 hours, 34 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mo...

PT-2026-80845

CVE-2026-73323 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-73323 Published : Aug. 21, 2026, 11:16 p.m. | 3 hours, 34 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for...

PT-2026-80820

CVE-2026-11615 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-11615 Published : Aug. 21, 2026, 11:16 p.m. | 3 hours, 34 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for...

CVE-2026-16577

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

EUVD-2026-63819

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

CVE-2026-16577

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, in versions before 5.0.14 , contains a vulnerability where it fails to validate client-supplied payment amounts against a vendor's actual outstanding balance during reverse-withdrawal payments . This flaw allows ...

CVE-2026-16577 Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

CVE-2026-16577: Incorrect Authorization

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

PT-2026-79303

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

WordPress Premium Packages - Sell Digital Products Securely plugin < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability

WordPress Premium Packages - Sell Digital Products Securely plugin 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability discovered by Farid Narimanov in WordPress Plugin WPDM – Premium Packages versions 7.0.7...

CVE-2026-16058 YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

CVE-2026-19711

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

CVE-2026-19711 Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

CVE-2026-19711 Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

CVE-2026-19711

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

CVE-2026-19711: Improper Access Control

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...