405,427 results · Feed
-
Medium 4.3
WebTorrent File Path torrent.js getFileModtimes path traversal
A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The…
-
High 8.1
Missing Authorization in TÜBİTAK BİLGEM's Liderahenk
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3.
-
High 7.3
itsourcecode Airline Reservation System manage_flight.php sql injection
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. …
-
Critical 10.0
Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument ex…
-
Medium 5.3
Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided b…
-
Medium 4.0
Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by t…
-
High 7.4
aaPanel BillionMail Relay Configuration API relay.go injection
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead …
-
Medium 4.3
Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host p…
-
Medium 5.3
Pantum BP5100DW Web omDB.shtml missing authentication
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remo…
-
Critical 9.8
Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attac…
-
High 7.3CVE-2026-124576 Public exploit
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…
-
Low 3.7
SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of…
-
Medium 6.3
chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper…
-
High 7.3
logseq Local HTTP API server.cljs validate-auth-token missing authentication
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from …
-
Medium 5.4
DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The ma…
-
Critical 9.8
WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achi…
-
Medium 5.3
Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user acco…
-
Medium 5.3
UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unau…
-
High 7.5
Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
-
Low 3.7
GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneo…
-
Medium 5.3
Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wid…
-
Medium 5.9
GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's St…
-
Medium 4.4
WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checko…
-
Medium 5.3
All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of passwor…
-
Medium 4.9
Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash…
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions,…
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, i…
-
High 8.8
WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator acc…
-
Critical 9.8
EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticat…
-
Critical 9.8
Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the s…
-
High 7.5
Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone…
-
High 7.5
Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login i…
-
High 7.5
Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's passwo…
-
High 8.8
AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an…
-
High 8.8
mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a …
-
Medium 6.3
SourceCodester Simple CRUD using PHP and FPDF register.php sql injection
A flaw has been found in SourceCodester Simple CRUD using PHP and FPDF 1.0. Affected by this vulnerability is an unknown functionality of the file app/register.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack can b…
-
Low 2.4
SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting
A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar …
-
Medium 5.4
fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in imp…
-
Medium 4.3
fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control
A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is pos…
-
Medium 4.3
fushengqian fuint ClientOrderController.java receipt state issue
A flaw has been found in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This issue affects the function receipt of the file ClientOrderController.java. Executing a manipulation can lead to state issue. The attack may be performed from remot…