OSTE-Meta-Scan

OSTE-Meta-Scanner This project is now maintained and supported by OSTE and is no longer available as an open-source project. For inquiries, commercial use, or support, please contact OSTE via LinkedIn, or official website, or sales team at +213.7.98.38.94.54 via whatsup. This project aims to...

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 3.2.14 . The root cause is the plugin's failure to properly verify user permissions for specific actions. This flaw allows unauthenticated attackers to write arbitrary ...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1 . The root cause is insufficient input sanitization and output escaping of the 'vars' parameter . An unauthenticated attacker can inject arbitra...

banrays

Ban-Rays Glasses to detect smart-glasses that have cameras I'm experimenting with 2 main approaches: Optics: classify the camera using light reflections. Networking: bluetooth and wi-fi analysis. So far fingerprinting specific devices based on bluetooth BLE is looking like easiest and most reliab...

meta-ai-support-prompt

Meta AI Support Assistant System Prompt Extracted system prompt from Meta's AI Support Assistant on June 1, 2026. Files system-prompt.md — Extracted system prompt ⚠️ Disclaimer & Legal Notice Purpose This repository is published strictly for educational and authorized security research purposes...

meta-lobbying-and-other-findings

Website: https://tboteproject.com Most Recent Repository: https://tboteproject.com/git/hekate/attestation-findings Help keep the server running! Monero: 451CjP6mgu12yvmDLxLduYYw5Py3Nnb91RwoRYCnhMwhGKM5hxYSaAWapq7CdRQz3qRJbUqqrnYBzW7L4aUt7nhbAYGmLSX Thank you for your support. Meta Platforms:...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

HackBot

HackBot - AI Cybersecurity Chatbot | | | | | | | | | | || |/ |/ | |/ / \ / | | By: Morpheuslord | | | | | | | | | | AI used: Meta-LLama2 || ||,|||\/ / | Introduction Welcome to HackBot, an AI-powered cybersecurity chatbot designed to provide helpful and accurate answers to your...

CVE-2026-119259

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflat...

WordPress All-in-One Video Gallery plugin < 5.1.0 - Unauthenticated Views and Duration Post Meta Write vulnerability

Unauthenticated Views and Duration Post Meta Write vulnerability discovered by Naoki Kawahigashi in WordPress Plugin All-in-One Video Gallery versions 5.1.0...

EUVD-2026-117903

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflat...

CVE-2026-119259 All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflat...

CVE-2026-120408 All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored...

CVE-2026-120408

The All-in-One Video Gallery WordPress plugin, in versions prior to 5.1.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to escape a video's stored thumbnail URL before displaying it in the admin video list and fails to sanitize this value when wri...

CVE-2026-119259

The All-in-One Video Gallery WordPress plugin, in versions prior to 5.1.0 , is vulnerable to an authorization bypass. The plugin fails to validate the type, status, or ownership of a target post when writing view count and duration metadata. This allows unauthenticated visitors to create or modif...

User Meta WP Plugin < 3.1 - Sensitive Information Exposure

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. id: CVE-2024-33575 info: name: User Meta WP Plugin 3.1 -...

WordPress Meta SEO <= 4.5.2 - Open Redirect

The WP Meta SEO WordPress plugin before 4.5.3 did not authorize several AJAX actions, which allowed low-privilege users to update certain data and resulted in an arbitrary redirect vulnerability. id: CVE-2023-0876 info: name: WordPress Meta SEO = 4.5.2 - Open Redirect author: Khalid6468 severity:...

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

WordPress Redirection for Contact Form 7 plugin <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy vulnerability discovered by Wordfence PRISM in WordPress Plugin Redirection for Contact Form 7 versions = 3.2.14...