🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73917CVSS Score:
9.1 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73920CVSS Score:
9.4 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73921CVSS Score:
9.8 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73922CVSS Score:
9.1 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73924CVSS Score:
9.1 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-73930CVSS Score:
9.9 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75976CVSS Score:
9.9 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75984CVSS Score:
7.4 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type causes command injection. The attack may be initiated remotely. The exploit has been published and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75985CVSS Score:
7.4 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type causes command injection. The attack may be initiated remotely. The exploit has been published and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75986CVSS Score:
7.3 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75987CVSS Score:
7.3 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76048CVSS Score:
7.3 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76003CVSS Score:
9.9 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76004CVSS Score:
9.9 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - CRITICAL)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76008CVSS Score:
10.0 (CRITICAL)Exploit Probability (EPSS):
Data UnavailableDetails: A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save_menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76049CVSS Score:
7.3 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save_menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-76050CVSS Score:
7.3 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-19942CVSS Score:
8.1 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-15780CVSS Score:
7.2 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
🔥 VULNERABILITY ALERT (NVD - HIGH)
CVE Reference:
CVSS Score:
Exploit Probability (EPSS):
Details: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel
-----------------------CVE Reference:
CVE-2026-75981CVSS Score:
7.2 (HIGH)Exploit Probability (EPSS):
Data UnavailableDetails: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
-----------------------🌐 OSINT Asset Dorks:
• Shodan CVE Search
🔗 External Reference:
• NVD CVE Detail
📢 Channel:
• Join Echo Intel