VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-15T06:32:41Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-15 07:32:45 +01:00
1 parent 833b6fbb8a
commit cfa869d9ba
17 files changed
+1184 -955
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/103xxx/CVE-2026-103361.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-103361",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-09-30T12:50:01.945Z",
"datePublished": "2026-11-15T06:00:06.464Z",
"dateUpdated": "2026-11-15T06:00:06.464Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:06.464Z"
},
"title": "Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Payment Gateway via Valitor for WooCommerce",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "1.9.41"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/f368f380-c003-4701-82be-19990fa69818/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Naoki Kawahigashi",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/110xxx/CVE-2026-110960.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110960",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-15T09:33:04.187Z",
"datePublished": "2026-11-15T06:00:06.639Z",
"dateUpdated": "2026-11-15T06:00:06.639Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:06.639Z"
},
"title": "Auth Armor <= 1.0.3 - Unauthenticated Account Takeover",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Auth Armor",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "1.0.3"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/84878a65-29f3-4cb9-96dd-b3f35baa21f0/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Muni Nitish Kumar Yaddala",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/110xxx/CVE-2026-110984.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110984",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-15T11:31:06.603Z",
"datePublished": "2026-11-15T06:00:06.816Z",
"dateUpdated": "2026-11-15T06:00:06.816Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:06.816Z"
},
"title": "RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "RegistrationMagic",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "6.1.0.4"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/331347d3-bc62-4727-b80c-0c7cc5df6031/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Dion Mulaj",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/110xxx/CVE-2026-110987.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110987",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-15T11:31:38.494Z",
"datePublished": "2026-11-15T06:00:06.993Z",
"dateUpdated": "2026-11-15T06:00:06.993Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:06.993Z"
},
"title": "RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Cross-Site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "RegistrationMagic",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "6.1.0.4"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/2a4e7700-fecb-49e9-bd6f-6d36e785115a/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Karthik Ramakrishnan",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/110xxx/CVE-2026-110989.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110989",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-15T11:32:14.612Z",
"datePublished": "2026-11-15T06:00:07.169Z",
"dateUpdated": "2026-11-15T06:00:07.169Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:07.169Z"
},
"title": "RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "RegistrationMagic",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "5.2.3.1",
"lessThan": "6.1.0.4"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/3992979c-8808-4888-9e6a-658bf4f8c317/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "BINESH MADHARAPU",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/114xxx/CVE-2026-114451.json
+92
View File
@@ -0,0 +1,92 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-114451",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-21T14:28:47.784Z",
"datePublished": "2026-11-15T06:00:07.344Z",
"dateUpdated": "2026-11-15T06:00:07.344Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:07.344Z"
},
"title": "Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Membership Plugin",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "4.0.6"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/74c09864-9f3e-4201-84ed-bf0aa562b500/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Naoki Kawahigashi",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/114xxx/CVE-2026-114452.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-114452",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-21T14:28:51.746Z",
"datePublished": "2026-11-15T06:00:07.518Z",
"dateUpdated": "2026-11-15T06:00:07.518Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:07.518Z"
},
"title": "Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Membership Plugin",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "3.2.17",
"lessThan": "4.0.6"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and attach a payment method of their choosing to another member's pending payment."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/2694318a-07b5-483c-a3f1-4511022c6d5d/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Het Kalariya",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/116xxx/CVE-2026-116559.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116559",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-10-26T14:47:37.486Z",
"datePublished": "2026-11-15T06:00:06.286Z",
"dateUpdated": "2026-11-15T06:00:06.286Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:06.286Z"
},
"title": "A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "A2Reviews",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "1.2.3"
}
],
"defaultStatus": "unknown"
}
],
"descriptions": [
{
"lang": "en",
"value": "The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/313ed902-a4ad-46d2-9a84-3cbc94464dab/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Erwan LR (WPScan)",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/123xxx/CVE-2026-123707.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123707",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-11-06T09:57:43.093Z",
"datePublished": "2026-11-15T06:00:07.944Z",
"dateUpdated": "2026-11-15T06:00:07.944Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:07.944Z"
},
"title": "WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "WPGraphQL",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "2.27.1"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/ae3506eb-c023-4af6-b3c0-5c2600b2b502/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Aabideen Bangash",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/124xxx/CVE-2026-124671.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124671",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-11-09T09:41:48.740Z",
"datePublished": "2026-11-15T06:00:08.116Z",
"dateUpdated": "2026-11-15T06:00:08.116Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:08.116Z"
},
"title": "Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Burst Statistics",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.7.5"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-62b07c54e1b2/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Raphael P. Cigana",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/124xxx/CVE-2026-124673.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-124673",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-11-09T09:41:52.376Z",
"datePublished": "2026-11-15T06:00:08.526Z",
"dateUpdated": "2026-11-15T06:00:08.526Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:08.526Z"
},
"title": "Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Burst Statistics",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.7.5"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/88abcecb-e1cf-4e81-b8d0-2f222de897fc/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Karthik Ramakrishnan",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/127xxx/CVE-2026-127048.json
+83
View File
@@ -0,0 +1,83 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127048",
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"state": "PUBLISHED",
"assignerShortName": "WPScan",
"dateReserved": "2026-11-12T12:08:49.688Z",
"datePublished": "2026-11-15T06:00:08.703Z",
"dateUpdated": "2026-11-15T06:00:08.703Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan",
"dateUpdated": "2026-11-15T06:00:08.703Z"
},
"title": "Lazy Blocks < 3.0.0 - Unauthenticated RCE",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "Unknown",
"product": "Custom Block Builder",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.0.0"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server."
}
],
"references": [
{
"url": "https://wpscan.com/vulnerability/b88c5a75-56ab-4722-8994-bbd6d97d2844/",
"tags": [
"exploit",
"vdb-entry",
"technical-description"
]
}
],
"credits": [
{
"lang": "en",
"value": "Mirza Muhammad Sanaullah",
"type": "finder"
},
{
"lang": "en",
"value": "WPScan",
"type": "coordinator"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
}
}
data/2026/33xxx/CVE-2026-33818.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-03-23T20:35:32.815Z",
"datePublished": "2026-08-13T21:58:52.821Z",
"dateUpdated": "2026-11-14T23:23:03.752Z"
"dateUpdated": "2026-11-15T05:21:16.004Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-14T23:23:03.752Z"
"dateUpdated": "2026-11-15T05:21:16.004Z"
},
"title": "Enforce maximum recursion depth in encoding/asn1",
"descriptions": [
data/2026/42xxx/CVE-2026-42504.json
+2 -2
View File
@@ -8,14 +8,14 @@
"assignerShortName": "Go",
"dateReserved": "2026-04-28T00:21:12.792Z",
"datePublished": "2026-06-02T22:01:37.219Z",
"dateUpdated": "2026-11-14T23:23:02.204Z"
"dateUpdated": "2026-11-15T05:21:14.470Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go",
"dateUpdated": "2026-11-14T23:23:02.204Z"
"dateUpdated": "2026-11-15T05:21:14.470Z"
},
"title": "Quadratic complexity in WordDecoder.DecodeHeader in mime",
"descriptions": [
data/delta.json
+72 -6
View File
@@ -1,12 +1,78 @@
{
"fetchTime": "2026-11-15T03:16:36.019Z",
"numberOfChanges": 1,
"fetchTime": "2026-11-15T06:19:19.594Z",
"numberOfChanges": 12,
"new": [
{
"cveId": "CVE-2026-129360",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129360",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129360.json",
"dateUpdated": "2026-11-15T03:15:17.488Z"
"cveId": "CVE-2026-103361",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-103361",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103361.json",
"dateUpdated": "2026-11-15T06:00:06.464Z"
},
{
"cveId": "CVE-2026-110960",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110960",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110960.json",
"dateUpdated": "2026-11-15T06:00:06.639Z"
},
{
"cveId": "CVE-2026-110984",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110984",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110984.json",
"dateUpdated": "2026-11-15T06:00:06.816Z"
},
{
"cveId": "CVE-2026-110987",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110987",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110987.json",
"dateUpdated": "2026-11-15T06:00:06.993Z"
},
{
"cveId": "CVE-2026-110989",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110989",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110989.json",
"dateUpdated": "2026-11-15T06:00:07.169Z"
},
{
"cveId": "CVE-2026-114451",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114451",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114451.json",
"dateUpdated": "2026-11-15T06:00:07.344Z"
},
{
"cveId": "CVE-2026-114452",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-114452",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114452.json",
"dateUpdated": "2026-11-15T06:00:07.518Z"
},
{
"cveId": "CVE-2026-116559",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-116559",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116559.json",
"dateUpdated": "2026-11-15T06:00:06.286Z"
},
{
"cveId": "CVE-2026-123707",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123707",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123707.json",
"dateUpdated": "2026-11-15T06:00:07.944Z"
},
{
"cveId": "CVE-2026-124671",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124671",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124671.json",
"dateUpdated": "2026-11-15T06:00:08.116Z"
},
{
"cveId": "CVE-2026-124673",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124673",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124673.json",
"dateUpdated": "2026-11-15T06:00:08.526Z"
},
{
"cveId": "CVE-2026-127048",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127048",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127048.json",
"dateUpdated": "2026-11-15T06:00:08.703Z"
}
],
"updated": [],
data/deltaLog.json
+100 -942
View File
File diff suppressed because it is too large. Load diff