Disclosures
Findings without a CVE
Verified issues that do not yet have a public CVE identifier — documented with product, version, root cause, impact and remediation, without publishing exploit material.
- findings
- 3
- No response
- 0
- Updated
- 2026-10-21
Findings without a CVE
3 / 3 Records · Updated 2026-10-21 · Filters apply instantly; the URL never changes.
← scroll the table horizontally →
| Component | CWE | Status | Expand | ||||
|---|---|---|---|---|---|---|---|
| FIND-2026-001FIND-2026-001No CVE | CriticalUnauthenticated blind SQL injection and missing authorization on order-update REST route | FEP API ConnectionAdvatix · WordPress plugin | CWE-89 | 9.1 | Reported | 2026-10-21 | |
| FIND-2026-002FIND-2026-002No CVE | HighAuthenticated arbitrary file read and configuration disclosure via CSRF middleware bypass | WPIDE — File Manager & Code EditorWPIDE · WordPress plugin | CWE-352 | 6.5 | Reported | 2026-10-21 | |
| FIND-2026-003FIND-2026-003No CVE | CriticalUnauthenticated arbitrary file upload through the plugin AJAX upload handler | WP Easy PayWP Easy Pay · WordPress plugin | CWE-434 | 9.8 | Reported | 2026-10-21 |
Why publish findings without a CVE?
Not every valid issue has a public CVE yet. Documenting them anyway shows the depth of the research: product and version, root cause, impact and remediation — without inflating the CVE list or publishing attack procedures.
Why no CVE
- FIND-2026-001 No public CVE identifier has been assigned yet. The issue was reported through coordinated disclosure channels; this record documents the product, versions, root cause and impact without publishing exploit material.
- FIND-2026-002 No public CVE identifier has been assigned yet. Documented here after local verification; exploit URLs and payloads are withheld from the public site.
- FIND-2026-003 No public CVE identifier has been assigned yet. Recorded after local verification; proof-of-concept requests are excluded from the public site.
A finding can be promoted to the CVE list once an identifier is assigned.
01 — Contact
Looking for a penetration testing internship (SOC secondary)
I can walk you through any report, the lab methodology behind it, and how I document findings for vendors.
Open to internship opportunities — timing flexible
I reply fastest by email. Happy to walk through any report, the methodology, or how I document findings.
Disclosure policy & safe harbor →