CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

EUVD-2025-211018

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2025-14564

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.0 . The root cause is insufficient input sanitization and output escaping during SVG file uploads. An authenticated attacker with Author-level access or hi...

RTF-Cleaner

RTF-Cleaner Deofuscador de RTF para documentos CVE-2017-0199 para encontrar URLs estáticamente. Use esta herramienta para encontrar URLs estáticamente en documentos RTF ofuscados. Uso: .\rtfCleanerUniversal.ps1 ruta-al-archivo Ejemplo: .\rtfCleanerUniversal.ps1...

swagger-ui

Introducción: El Rol de Swagger UI Swagger UI es una librería ampliamente utilizada que renderiza especificaciones OpenAPI anteriormente Swagger en una interfaz web interactiva. Permite a desarrolladores e integradores explorar y probar APIs sin necesidad de tener la implementación del backend...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85415

The Audio Player Block WordPress plugin, in versions prior to 1.6.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied URL before using it as a link target. This allows users with the Contributor role or higher to store mal...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2025-63571

Descripción Durante el análisis del sistema de IA ChatGPT GPT-5, se descubrió una vulnerabilidad de Server-Side Request Forgery SSRF. Este problema ocurre porque la aplicación obtiene y ejecuta automáticamente URLs externas enviadas por los usuarios por ejemplo, webhooks sin ninguna validación o...

CVE-2026-102911 zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wikicapturesource MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been...

cve-2023-2745

Cómo usar Guarde el archivo como checkcve-2023-2745.py y déle permiso de ejecución: chmod +x checkcve-2023-2745.py Instale la dependencia una vez: python3 -m pip install requests Ejecución: python3 checkcve-2023-2745.py https://example.com...

CVE-2024-21413-Outlook-Assessment

title: "CVE-2024-21413 Enlace Moniker: Evaluación de ejecución remota de código en Microsoft Outlook" date: 2026-06-28 author: Lindon Mitchell YoguiCR role: Investigador de Seguridad / Analista de Exploits status: Completado classification: Público / Portafolio environment: TryHackMe - Laboratori...

CVE-2025-11833-PoC

Comprobador de CVE-2025-11833 python3 main.py --url http://localhost --username admin --loot Este repositorio es solo para fines educativos y de investigación. El autor no asume ninguna responsabilidad por el uso indebido. Siempre prueba los PoCs en un entorno controlado y aislado...

CVE-2024-27564

CVE-2024-27564 Descripción: Una vulnerabilidad en pictureproxy.php permite a atacantes remotos realizar peticiones arbitrarias inyectando URLs en el parámetro url. Esta vulnerabilidad SSRF puede explotarse sin autenticación, lo que la hace particularmente peligrosa. El código vulnerable está en e...

POC_CVE-2025-53558

CVE-2025-53558 Descargo de responsabilidad Este programa debe utilizarse únicamente con fines de pruebas de seguridad autorizadas e investigación. Se solicita a los usuarios que lo empleen de forma responsable, de conformidad con la ley de ciberseguridad. El autor no se hace responsable de...