# cve.now: Cyberlord92

The newest entries naming Cyberlord92 as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118194](https://cve.now/CVE-2026-118194.md): Page and Post Restriction \<= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication (CVSS 6.5)
- [CVE-2026-103895](https://cve.now/CVE-2026-103895.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State (CVSS 8.1)
- [CVE-2026-85984](https://cve.now/CVE-2026-85984.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.5 - Unauthenticated Authentication Bypass via 'mo\_wp\_login\_intent' Parameter (CVSS 9.8)
- [CVE-2026-75807](https://cve.now/CVE-2026-75807.md): SAML Single Sign On \<= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning (CVSS 7.5)
- [CVE-2026-12000](https://cve.now/CVE-2026-12000.md): Page and Post Restriction \<= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API (CVSS 7.5)
- [CVE-2026-15981](https://cve.now/CVE-2026-15981.md): SAML Single Sign On \<= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter (CVSS 9.8)
- [CVE-2026-15013](https://cve.now/CVE-2026-15013.md): SAML Single Sign On \<= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion (CVSS 9.8)
- [CVE-2026-12761](https://cve.now/CVE-2026-12761.md): miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) \<= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow (CVSS 9.8)
- [CVE-2026-14245](https://cve.now/CVE-2026-14245.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username\_b' Parameter (CVSS 9.8)
- [CVE-2026-2628](https://cve.now/CVE-2026-2628.md): All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login \<= 2.2.5 - Authentication Bypass (CVSS 9.8)
- [CVE-2026-1279](https://cve.now/CVE-2026-1279.md): Employee Directory \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form\_title' Shortcode Attribute (CVSS 6.4)
- [CVE-2025-10753](https://cve.now/CVE-2025-10753.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.14 - Missing Authorization (CVSS 5.3)
- [CVE-2026-0725](https://cve.now/CVE-2026-0725.md): Integrate Dynamics 365 CRM \<= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration (CVSS 4.4)
- [CVE-2025-14948](https://cve.now/CVE-2025-14948.md): miniOrange OTP Verification and SMS Notification for WooCommerce \<= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification (CVSS 5.3)
- [CVE-2025-12822](https://cve.now/CVE-2025-12822.md): WP Login and Register using JWT \<= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure (CVSS 4.3)
- [CVE-2025-11255](https://cve.now/CVE-2025-11255.md): Password Policy Manager | Password Manager \<= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out (CVSS 4.3)
- [CVE-2025-10750](https://cve.now/CVE-2025-10750.md): PowerBI Embed Reports \<= 1.2.0 - Unauthenticated Sensitive Information Disclosure (CVSS 5.3)
- [CVE-2025-10648](https://cve.now/CVE-2025-10648.md): Login with YourMembership - YM SSO Login \<= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym\_display\_test\_attributes' (CVSS 5.3)
- [CVE-2025-9485](https://cve.now/CVE-2025-9485.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.12 - Authentication Bypass via get\_resource\_owner\_from\_id\_token() (CVSS 9.8)
- [CVE-2025-10746](https://cve.now/CVE-2025-10746.md): Integrate Dynamics 365 CRM \<= 1.0.9 - Missing Authorization (CVSS 6.5)
- [CVE-2025-10752](https://cve.now/CVE-2025-10752.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.12 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2025-7665](https://cve.now/CVE-2025-7665.md): Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation (CVSS 8.1)
- [CVE-2025-9891](https://cve.now/CVE-2025-9891.md): User Sync – Remote User Sync \<= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation (CVSS 4.3)
- [CVE-2025-8420](https://cve.now/CVE-2025-8420.md): Multiple Plugins by emarket-design \<= Multiple Versions - Unauthenticated Limited Remote Code Execution (CVSS 8.1)
- [CVE-2025-6003](https://cve.now/CVE-2025-6003.md): WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-11087](https://cve.now/CVE-2024-11087.md): miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon \<= 200.3.9 - Authentication Bypass (CVSS 8.1)
- [CVE-2023-46082](https://cve.now/CVE-2023-46082.md): WordPress Broken Link Checker | Finder plugin \<= 2.4.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-11297](https://cve.now/CVE-2024-11297.md): Page Restriction WordPress (WP) – Protect WP Pages/Post \<= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-12121](https://cve.now/CVE-2024-12121.md): Broken Link Checker | Finder \<= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery (CVSS 5.4)
- [CVE-2024-10111](https://cve.now/CVE-2024-10111.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.3 - Authentication Bypass (CVSS 8.1)
- [CVE-2024-11901](https://cve.now/CVE-2024-11901.md): PowerBI Embed Reports \<= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-9887](https://cve.now/CVE-2024-9887.md): Login using WordPress Users ( WP as SAML IDP ) \<= 1.15.6 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)
- [CVE-2024-9863](https://cve.now/CVE-2024-9863.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value (CVSS 9.8)
- [CVE-2024-9862](https://cve.now/CVE-2024-9862.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Unauthenticated Arbitrary User Password Change (CVSS 9.8)
- [CVE-2024-9861](https://cve.now/CVE-2024-9861.md): Miniorange OTP Verification with Firebase \<= 3.6.0 - Authentication Bypass (CVSS 8.1)
- [CVE-2022-4539](https://cve.now/CVE-2022-4539.md): Web Application Firewall \<= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 5.3)
- [CVE-2024-0681](https://cve.now/CVE-2024-0681.md): Page Restriction WordPress (WP) – Protect WP Pages/Post \<= 1.3.4 - Protection Mechanism Bypass (CVSS 5.3)
- [CVE-2024-2172](https://cve.now/CVE-2024-2172.md): Malware Scanner \<= 4.7.2 and Web Application Firewall \<= 2.1.1 - Unauthenticated Privilege Escalation (CVSS 9.8)
- [CVE-2022-4943](https://cve.now/CVE-2022-4943.md): miniOrange's Google Authenticator \<= 5.6.5 - Missing Authorization to Plugin Settings Change (CVSS 7.5)
- [CVE-2023-4505](https://cve.now/CVE-2023-4505.md): Staff / Employee Business Directory for Active Directory \<= 1.2.3 - Authenticated (Admin+) LDAP Passback (CVSS 2.2)
- [CVE-2023-4506](https://cve.now/CVE-2023-4506.md): Active Directory Integration / LDAP Integration \<= 4.1.10 - LDAP Passback (CVSS 2.2)
- [CVE-2023-3249](https://cve.now/CVE-2023-3249.md): Web3 – Crypto wallet Login & NFT token gating \<= 2.6.0 - Authentication Bypass (CVSS 9.8)
- [CVE-2023-3447](https://cve.now/CVE-2023-3447.md): Active Directory Integration / LDAP Integration \<= 4.1.5 - Authenticated (Subscriber+) LDAP Injection (CVSS 7.6)
- [CVE-2023-2982](https://cve.now/CVE-2023-2982.md): WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \<= 7.6.4 - Authentication Bypass (CVSS 9.8)
- [CVE-2023-2599](https://cve.now/CVE-2023-2599.md): Active Directory Integration / LDAP Integration \<= 4.1.4 - Cross-Site Request Forgery to SQL Injection (CVSS 3.1)
- [CVE-2023-2484](https://cve.now/CVE-2023-2484.md): Active Directory Integration / LDAP Integration \<= 4.1.4 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cyberlord92
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.