Francisco José Ramírez Vicente and Iñigo Sánchez Enciso

Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password