Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

cyberlord92 — Vulnerabilities & Security Advisories 43

Browse all 43 CVE security advisories affecting cyberlord92. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Operating primarily as an independent security researcher, cyberlord92 has established a significant footprint in the vulnerability disclosure landscape with thirty-six Common Vulnerabilities and Exposures (CVEs) currently on record. The majority of these findings target web applications, with Remote Code Execution (RCE) and Cross-Site Scripting (XSS) representing the most frequently exploited vulnerability classes. Privilege escalation flaws also appear with regularity, indicating a focus on gaining elevated access within compromised environments. Notable incidents include critical disclosures affecting major enterprise software platforms, which prompted rapid vendor patches and highlighted systemic architectural weaknesses. The profile suggests a methodical approach to penetration testing, prioritizing high-impact bugs over low-severity issues. This consistent output demonstrates a specialized expertise in identifying complex logic flaws and injection points, contributing substantially to the broader cybersecurity community’s understanding of application security risks.

CVE ID Title CVSS Severity Published
CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter — miniOrange OTP Login, Verification and SMS Notifications CWE-287 9.8 Critical 2026-09-26
CVE-2026-75807 SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning — SAML Single Sign On – SSO Login CWE-287 7.5 High 2026-08-29
CVE-2026-12000 Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API — Page and Post Restriction CWE-862 7.5 High 2026-08-05
CVE-2026-15981 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter — SAML Single Sign On – SSO Login CWE-287 9.8 Critical 2026-07-23
CVE-2026-15013 SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion — SAML Single Sign On – SSO Login CWE-347 9.8 Critical 2026-07-16
CVE-2026-12761 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow — miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) CWE-287 9.8 Critical 2026-07-10
CVE-2026-14245 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter — miniOrange OTP Login, Verification and SMS Notifications CWE-862 9.8 Critical 2026-07-09
CVE-2026-2628 All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass — All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login CWE-288 9.8 Critical 2026-03-03
CVE-2026-1279 Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute — Employee Directory – Staff Directory and Listing CWE-79 6.4 Medium 2026-02-06
CVE-2025-10753 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization — OAuth Single Sign On – SSO (OAuth Client) CWE-862 5.3 Medium 2026-02-06
CVE-2026-0725 Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration — Integrate Dynamics 365 CRM CWE-79 4.4 Medium 2026-01-17
CVE-2025-14948 miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification — miniOrange OTP Verification and SMS Notification for WooCommerce CWE-862 5.3 Medium 2026-01-10
CVE-2025-12822 WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure — WP Login and Register using JWT CWE-862 4.3 Medium 2025-11-19
CVE-2025-11255 Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out — Password Policy Manager | Password Manager CWE-862 4.3 Medium 2025-10-25
CVE-2025-10750 PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure — PowerBI Embed Reports CWE-200 5.3 Medium 2025-10-18
CVE-2025-10648 Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes' — Login with YourMembership – YM SSO Login CWE-862 5.3 Medium 2025-10-15
CVE-2025-9485 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token() — OAuth Single Sign On – SSO (OAuth Client) CWE-347 9.8 Critical 2025-10-04
CVE-2025-10746 Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization — Integrate Dynamics 365 CRM CWE-306 6.5 Medium 2025-10-04
CVE-2025-10752 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery — OAuth Single Sign On – SSO (OAuth Client) CWE-352 4.3 Medium 2025-09-26
CVE-2025-7665 Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation — Miniorange OTP Verification with Firebase CWE-862 8.1 High 2025-09-19
CVE-2025-9891 User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation — User Sync CWE-352 4.3 Medium 2025-09-17
CVE-2025-6003 WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure — WordPress Single Sign-On (SSO) - Single Site Standard CWE-863 5.3 Medium 2025-06-12
CVE-2024-11087 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass — miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) CWE-287 8.1 High 2025-03-08
CVE-2023-46082 WordPress Broken Link Checker | Finder plugin <= 2.4.2 - Broken Access Control vulnerability — Broken Link Checker | Finder CWE-862 5.3 Medium 2025-01-02
CVE-2024-11297 Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure — Page and Post Restriction CWE-200 5.3 Medium 2024-12-20
CVE-2024-12121 Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery — Broken Link Checker | Finder CWE-918 5.4 Medium 2024-12-19
CVE-2024-10111 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass — OAuth Single Sign On – SSO (OAuth Client) CWE-287 8.1 High 2024-12-12
CVE-2024-11901 PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting — PowerBI Embed Reports CWE-79 6.4 Medium 2024-12-12
CVE-2024-9887 Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection — SAML IDP (Identity Provider) – Login with Website Users CWE-89 7.2 High 2024-11-16
CVE-2024-9863 Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value — Miniorange OTP Verification with Firebase CWE-266 9.8 Critical 2024-10-17

This page lists every published CVE security advisory associated with cyberlord92. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.