2026-09-19 归档

今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。

← 返回归档列表

漏洞预警2026-09-18 发布INFO

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing ...

CVE-2026-88798

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-09-18 发布INFO

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updatin...

CVE-2026-87966

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the...

CVE-2026-87965

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-18 发布INFO

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthen...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthen...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthentica...

CVE-2026-87771

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauth...

CVE-2026-87770

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available t...

CVE-2026-87767

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter bef

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unaut...

CVE-2026-85350

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-18 发布INFO

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize t...

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing una...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-18 发布INFO

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing una...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthentic...

CVE-2026-85009

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a c...

CVE-2026-84904

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a gro

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-18 发布INFO

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied po...

CVE-2026-84903

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-18 发布INFO

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users w...

CVE-2026-84902

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-18 发布INFO

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wi...

CVE-2026-81810

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-18 发布INFO

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowi...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolle

历史摘要 · 未重新核验 · NVD

#cve #cwe-20