← 返回地图破甲

浏览报告

仅含 CVE

96 份报告 · 本页赏金 $0 · 清除筛选

Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields信息泄露WordPress中危—2026-11-05 Information Disclosure - Unauthen Leak Private Content信息泄露WordPress低危—2026-10-10 CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content身份认证WordPress低危—2026-10-30 WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses访问控制WordPress低危—2026-11-05 wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles访问控制WordPress中危—2026-11-05 Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order访问控制WordPress中危—2026-11-05 wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list开放重定向WordPress低危—2026-10-30 Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`路径遍历WordPress高危—2026-08-28 Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`跨站脚本WordPress高危—2026-08-28 WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE代码执行WordPress中危—2026-10-21 Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations访问控制WordPress低危—2026-09-28 Large-site Quick Edit reparses a Contributor display name into active HTML跨站脚本WordPress低危—2026-10-21 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports访问控制WordPress中危—2026-11-05 Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint访问控制WordPress高危—2026-10-12 Pivilege escalation of any new user to Keymaster caused by CSRF访问控制WordPress低危—2025-09-13 Unauthenticated WordPress Database Repair DoS拒绝服务WordPress中危—2024-10-18 wp-embed XSS on Safari跨站脚本WordPress低危—2023-07-01 PII of users can be downloaded from export pages信息泄露WordPress低危—2023-05-12 Privilege Escalation via REST API to Administrator leads to RCE访问控制WordPress中危—2021-05-17 Authenticated XXE注入与走私WordPress低危—2021-05-18 Clickjacking on donation page错误配置WordPress低危—2020-07-16 CSRF on comment post跨站请求伪造WordPress低危—2020-07-16 Authenticated Stored Cross-site Scripting in bbPress跨站脚本WordPress低危—2020-06-29 Arbitrary change of blog's background image via CSRF跨站请求伪造WordPress低危—2020-12-14 Improper Access Control in Buddypress core allows reply,delete any user's activity访问控制WordPress低危—2020-05-22