Jakub Herman

Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite

Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters

Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment