京ICP证080047号[京ICP备08010314号-6]
本条目经解析后未发现任何有效的威胁情报内容。其标题为“京ICP证080047号[京备08010314号-6]”，疑似为中国工信部ICP备案信息，但来源名称标注为“360CERT安全报告”，来源URL指向工信部备案查询网站（beian.mii
2026-08-27 归档
今日共收录 918 条安全情报，包含 88 个 CVE，417 篇安全通告，以及 120 篇研究论文。
← 返回归档列表The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due t...
CVE-2026-18884
CVE-2026-18884涉及WordPress的WooCommerce Lottery插件，该插件用于管理彩票/抽奖活动，影响版本为2.2.9及之前全部版本。漏洞类型为基于时间的SQL注入（Time-Based SQL Injectio
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to...
CVE-2026-3002
CVE-2026-3002 是一个影响 WordPress 插件 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem 的存储型跨站脚本（XSS）漏洞。该插件用于增强 W
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_...
CVE-2026-18331
Formidable Forms 是一款在 WordPress 中广泛使用的表单构建插件，支持联系表单、计算器、测验等多种功能。在其 6.33.1 及之前的所有版本中，发现了一个存储型跨站脚本（XSS）漏洞，编号为 CVE-2026-183
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page
CVE-2026-15366
本漏洞涉及 Kids Mode（儿童模式）中一个内置网页的控制逻辑缺陷。该缺陷允许用户直接在页面内查看本地图库中的照片，无需额外授权，从而绕过了儿童模式对敏感内容（如本地媒体文件）的访问限制。从技术角度看，这属于一种访问控制或逻辑校验不严的
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.
CVE-2026-15365
CVE-2026-15365 涉及儿童模式（Kids Mode）中某一功能的弹窗逻辑缺陷。该缺陷允许用户绕过密码验证，在应用外部使用快速应用（Quick Apps），从而突破家长控制的安全边界。目前，该漏洞仅有基础元数据，未提供 CVSS
The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such a...
CVE-2026-77790
CVE-2026-77790是RegistrationMagic WordPress插件中的一个SQL注入漏洞。该插件在6.0.9.4版本之前，未对某些参数进行充分的清理和转义，导致其可以在构造SQL语句时被注入恶意内容。由于该漏洞影响的是
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal sessio...
CVE-2026-77789
CVE-2026-77789 是 WordPress 插件“Stripe Payment Forms by WP Full Pay”中存在的一个逻辑缺陷漏洞，影响 8.5.1 之前的版本。该插件用于在 WordPress 站点上集成 Str
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the ...
CVE-2026-77757
CVE-2026-77757 是影响 WordPress 插件 Directorist（AI 驱动的商业目录、列表和分类广告）的一个文件操作漏洞。该插件在 8.9.3 版本之前，对用户提供的图像引用缺乏充分的输入清理。具体而言，当插件使用用
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users t...
CVE-2026-77694
CVE-2026-77694 是 WordPress 的 Eventin 插件（版本 < 4.1.19）中存在的一个安全漏洞。该插件用于活动管理和票务销售。漏洞的根源在于插件对访客结账令牌（guest checkout token）的授权范
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted,...
CVE-2026-77693
该漏洞存在于 Order Tip for WooCommerce WordPress 插件 1.6.0 之前的版本中。插件在处理文件删除的请求时，既没有检查发起请求用户的权限能力，也没有限制可被删除的路径范围。因此，凡是拥有 Shop Ma
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anony...
CVE-2026-75798
The AI Engine WordPress 插件在 3.7.2 之前的版本中存在一个安全漏洞。该插件的一个管理专用功能（administration-only feature）在执行授权检查时存在缺失，而是依赖于一个分发给匿名访问者的令
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a...
CVE-2026-74929
CVE-2026-74929 是 WordPress 的 Project Manager 插件（版本 4.0.7 之前）中存在的一个访问控制不当漏洞。该插件提供的多个 REST API 路由未检查请求用户是否属于某个项目，导致任何已登录用户
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Cloud ManagerManage your cloud computing services
Cloud ManagerManage your cloud computing services
See all Cloud Computing
See all Cloud Computing
智利银行在勒索软件攻击后关闭所有分行
智利银行在勒索软件攻击后关闭所有分行
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018