← 返回地图破甲

浏览报告

仅含 CVE

166 份报告 · 本页赏金 $0 · 清除筛选

XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution代码执行Automattic未评级—2026-02-18 Woocommerce SQL Injection in WC_Report_Coupon_UsageSQL 注入Automattic低危—2025-06-24 Open redirect via redirect_to parameter in tumblr.com开放重定向Automattic低危—2024-11-05 Race condition on add 1 free domain业务逻辑Automattic低危—2025-05-09 Authentication & Registration Bypass in Newspack Extended Access身份认证Automattic低危—2024-07-05 Authentication & Registration Bypass in Newspack Extended Access身份认证Automattic低危—2024-05-20 DOM XSS on multiple Automattic domains through postMessages跨站脚本Automattic中危—2024-02-26 Timeline API returns private post when target of a push notification访问控制Automattic低危—2024-10-17 reflected xss in https://wordpress.com/start/account/user跨站脚本Automattic低危—2023-11-15 Entering passwords on the Share Login Page can lead to a brute-force attack身份认证Automattic低危—2023-08-27 Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interaction身份认证Automattic中危—2023-12-28 Stored XSS on wordpress.com跨站脚本Automattic低危—2023-06-26 Stored XSS on wordpress.com跨站脚本Automattic低危—2023-05-19 Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header跨站脚本Automattic低危—2023-02-24 Akismet API keys are exposed by authentication method信息泄露Automattic低危—2022-12-16 Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins]访问控制Automattic低危—2022-11-03 IDOR in API applications (able to see any API token, leads to account takeover)不安全的直接对象引用Automattic高危—2022-11-01 IDOR able to buy a plan with lesser fee不安全的直接对象引用Automattic低危—2022-10-19 Stored XSS in intensedebate.com via the Comments RSS其他弱点Automattic低危—2022-11-02 Sensei LMS IDOR to send message不安全的直接对象引用Automattic低危—2022-08-04 Unauthenticated Private Messages DIsclosure via wordpress Rest API信息泄露Automattic低危—2022-08-04 Site information's Display Name section vulnerable for XSS attacks and HTML Injections.跨站脚本Automattic低危—2022-05-16 XSS and HTML Injection on the pressable.com search box跨站脚本Automattic低危—2022-08-23 De-anonymize anonymous tips through the Tumblr blog network信息泄露Automattic低危—2022-02-21 Ability to subscribe to inactive Post+ creators业务逻辑Automattic低危—2021-10-05