CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI→RCE エクスプロイト 事前認証不要の'tab'パラメータによるパストラバーサル → ローカルファイルインクルージョン 概要 CVE-2026-9290 は、WP User Manager – User Profile Builder & Membership WordPressプラグイン ≤ 2.9.17 における高深刻度 CVSS 7.5 の認証不要のローカルファイルインクルージョン脆弱性です。 wpumgetactiveprofiletab 関数は、ホワイトリスト検証なしで tab クエリパラメータを直接...

CVE-2026-39117

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php...

Fedora 43 : perl-Catalyst-Plugin-Static-Simple (2026-7c46481544)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c46481544 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Fedora 45 : perl-Catalyst-Plugin-Static-Simple (2026-4d5a716383)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d5a716383 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

CVE-2026-39117

A vulnerability exists in AltumCode 66Uptime (prior to v.54.0.0 ) and the 66Uptime ping-servers plugin (prior to v.2.0.0 ). A remote attacker can exploit an issue in the index.php file to achieve arbitrary code execution . Exploitation details are not provided in the documents. Remediation inform...

SUSE CVE-2026-67222

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

SUSE CVE-2026-67225

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-81780-Hash-Form

CVE-2026-81780-Hash-Form CVE-2026-81780 — Hash Form 远程代码执行漏洞 漏洞详情 WordPress Hash Form 插件（≤ 1.4.2）存在未授权文件上传漏洞。该插件允许任意文件上传，且未进行适当的身份验证或文件类型校验，从而导致远程代码执行（RCE）。 漏洞利用链 步骤 操作 1 攻击者通过 readme.txt 检测 Hash Form 插件 2 通过预览表单（hashformpreview）提取 ajaxnounce 3 向 hashformfileuploadaction 发送携带 PHP 载荷的 POST 请求 4 以...

CVE-2026-49952

setup pip3 install Pillow torch torchvision run $ python3 exploit.py http://localhost/discuz5/ +----------------------------------------------------+ | Discuz! X5.0 Remote Code Execution Exploit by EgiX | +----------------------------------------------------+ + Getting authcode for DB export +...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Apache APISIX jwe-decrypt Authentication Bypass Proof of concept for an authentication bypass in the Apache APISIX jwe-decrypt plugin. The plugin decrypts a JWE token and forwards its plaintext to the upstream, acting as an authentication gate — but it never validates the AES-GCM...

CVE-2025-22510

CVE-2025-22510 1️⃣ コンポーネントタイプ WordPress プラグイン 2️⃣ コンポーネント詳細 コンポーネント名 WC Price History for Omnibus 影響を受けるバージョン このプラグインを有効化するには、事前に WooCommerce プラグインがインストールされ、有効化されている必要があります。 2. PHP オブジェクトインジェクションの脆弱性をテストするには、次のクラス PoCPOPChainObject を wp-config.php ファイルの末尾に追加します。 class PoCPOPChainObject public...

CVE-2026-11961

CVE-2026-11961 WordPress プラグイン User Registration & Membership に影響する CVE-2026-11961 の大量活用ツール。 特徴 プラグインのバージョン検出 単一ターゲットのサポート バッチターゲット処理 マルチスレッドサポート ランダムまたはカスタム認証情報 HTTP/HTTPS プロキシサポート リクエストタイムアウト設定 JSONL 出力 ログファイルサポート Telegram 通知 フォースモード --force 使用方法 ヘルプを表示 python3 mass.py -h 単一ターゲット python3 mass.p...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

CVE-2023-4281

CVE ID: CVE-2023-4281 Vulnerability Type: IP Address Spoofing Description: The Activity Log plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce: Run the...

CVE-2019-17234b-Exploit

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plugin v3.4 and below allows remote unauthenticated users to potentially arbitrarily delete any file on target webserver possibly causing a Denial of Service attack. CVE-2019-17234 timeline The vulnerability was reported to wordpress.org...

CVE-2023-4549

CVE ID : CVE-2023-4549 Vulnerability Type : Cross-Site Scripting Description : The DoLogin Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping...

codesnippets_CVE-2020-8417

This repository does not have a README...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 1つの隠しフィールド。1つの値の改変。Webサイト全体への完全なアクセス。 🧨 攻撃者は何ができるのか? 攻撃能力| 影響 ---|--- 🔑 ログインなしで管理者アカウントを作成| サイト完全乗っ取り Full Site Takeover 📦 WooCommerceの顧客データにアクセス| データ漏洩 Data Breach 💉 プラグイン/テーマファイル PHP を編集| リモートコード実行 Remote Code Execution 🕳️ 隠しバックドアを作成| 永続的アクセス Persistent Access 👥...