Raphael P. Cigana

SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token

WP Data Access < 5.5.88 - Subscriber+ SSRF

Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export

Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()

Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin