1285 matches found
CVE-2025-57819_FreePBX
🛡️ CVE-2025-57819 – Inyección SQL no autenticada a RCE en FreePBX PoC Este repositorio contiene dos scripts de Prueba de Concepto PoC en Python dirigidos a CVE-2025-57819 , una vulnerabilidad crítica de inyección SQL no autenticada en FreePBX. 🧠 Acerca de la vulnerabilidad CVE-2025-57819...
CVE-2021-24762
Resumen Este repositorio documenta la detección de CVE-2021-24762, una vulnerabilidad identificada en una instancia de WordPress mediante escaneo HTTP. La vulnerabilidad fue descubierta en el endpoint AJAX de WordPress: /wp-admin/admin-ajax.php Este endpoint es utilizado comúnmente por plugins y...
CVE-2024-50450
CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Ejecución arbitraria de shortcode no autenticada Descripción: El plugin MDTF – Meta Data and Taxonomies Filter para WordPress es vulnerable a la ejecución arbitraria de shortcodes en todas las versiones hasta la 1.3.3.4...
0-click-RCE-Exploit-for-CVE-2024-51793
CVE-2024-51793 / Exploit RCE de 0-Click Autor: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-51793, una vulnerabilidad de subida de archivos arbitrarios sin autenticación en un plugin de WordPress...
CVE-2024-52430
CVE-2024-52430 Lis Video Gallery = 0.2.1 - 未认证的PHP对象注入 描述 Lis Video Gallery WordPress插件在版本0.2.1及以下存在PHP对象注入漏洞，攻击者可通过反序列化不可信输入进行利用。这使得未认证的攻击者能够注入一个PHP对象。受影响软件中不存在已知的POP链。如果目标系统上安装了其他插件或主题中存在POP链，攻击者可能利用该漏洞删除任意文件、获取敏感数据或执行代码。 CVE: CVE-2024-52430 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CV...
Exploit for CVE-2026-15989
█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗...
CVE-2026-27540
🌐 Idioma / Dil 📌 Resumen WooCommerce Wholesale Lead Capture WWLC — Carga de archivos sin autenticación → RCE | ---|--- Producto| WooCommerce Wholesale Lead Capture — plugin wwlc Versión| ≤ 2.0.3.1 Corregido| 2.0.3.2+ — manejador de carga protegido Auth| Sin autenticación Vector|...
CVE-2026-89055
CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Omisión de Autorización PoC en Python 3 para CVE-2026-89055 en Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Descripción PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 es...
Exploit for CVE-2026-96349
CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...
Exploit for CVE-2026-17089
CVE-2026-17089 — Events Manager is in the response == RESU...
EUVD-2026-83616
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988
QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...
CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
PT-2026-95872
Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...
CVE-2026-89064: Insufficiently Protected Credentials
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
PT-2026-94137
Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...