wphardening

WPHardening Fortify the security of any WordPress installation. ❮ NOTE ❯ This tool releases new versions on a regular basis. Make sure to update your dependencies frequently to get the latest version. Check out the changelog or CHANGELOG.md to learn about the new features. Installation Installing...

Config-Exploiter

Config-Exploiter Config-Exploiter : scarica il file config.php da siti Web Joomla e Wordpress Programma di Belahsan Ouerghi . Installazione root@kitploit: sudo apt-get install git git clone https://github.com/TunisianEagles/Config-Exploiter.git cd Config-Exploiter chmod +x install.sh sudo...

CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 Dimostrazione di concetto PoC Descrizione Questo repository contiene un exploit Proof of Concept PoC per CVE-2023-6972. La vulnerabilità consente la cancellazione arbitraria di file non autenticata AFD nel plugin Wordpress Backup Migration Nota: Un'analisi tecnica completa, un caso ...

wp-mail-masta-exploit

WordPress Plugin Mail Masta 1.0 - Exploit da CVE-2016-10956 Este script explora a vulnerabilidade CVE-2016-10956 no WordPress Plugin Mail Masta 1.0 para extrair credenciais de wp-config.php. Como Usar 1. Clone o repositório: root@kitploit: git clone...

wp-allowed-hosts

WP Allowed Hosts Dieses Plugin wurde erstellt, nachdem die Schwachstelle CVE-2017-8295 offengelegt wurde, dieses Plugin schützt Sie ohne Aufwand vor diesem Angriff – fügen Sie einfach eine Zeile in Ihre wp-config.php ein. Installation Laden Sie das Plugin einfach von hier herunter und laden Sie e...

CVE-2024-6460

CVE-2024-6460 Grow by Tradedoubler 2.0.22 - बिना प्रमाणीकरण के LFI उपयोग root@kitploit: usage: CVE-2024-6460.py -h -u URL -U USERNAME -P PASSWORD -c COMPONENT Grow by Tradedoubler 2.0.22 - Unauthenticated LFI options: -h, --help show this help message and exit -u URL, --url URL Target WordPress...

wordpress-true-ranker-cve-2021-39312

Plugin WordPress The True Ranker 2.2.2 - Lettura Arbitraria di File Proof-of-concept in Python per CVE-2021-39312 , che colpisce il plugin WordPress The True Ranker seo-local-rank versioni ≤ 2.2.2. Dettagli della Vulnerabilità CVE: CVE-2021-39312 Tipo: Lettura Arbitraria di File Plugin Affetto: T...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit für CVE-2023-47504. Laut NIST sollte diese Schwachstelle nicht authentifizierten Benutzern den Zugriff auf Funktionen des Elementor Website Builder Plugins ermöglichen. Basierend auf meiner Recherche zu der Schwachstelle und auch anhand der URL von Patchstack, die die...

PT-2026-73086

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on...

CVE-2026-14484

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

EUVD-2026-58835

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

CVE-2026-73033

CVE-2026-73033 affects the Sucuri Security WordPress plugin up to version 2.7.3. A path traversal flaw exists in the pageIntegritySubmission() function (src/integrity.lib.php) that lets authenticated administrators delete arbitrary files by supplying directory traversal sequences via the sucurisc...

EUVD-2026-49989

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

Exploit for Cross-site Scripting in Combodo Itop

CVE-2023-36664: Ghostscript Remote Code Execution 취약점 요약...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-43921

FOSSBilling is affected by a PHP code injection in versions 0.6.10–0.7.2 via Config::prettyPrintArrayToPHP(), where updated configuration values are written to config.php without escaping single quotes. Because config.php is loaded with a bare include on each HTTP request, an admin with privilege...

CVE-2026-43921 FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP method. When configuration values are updated, string values are written into config.php without escaping...

EUVD-2026-39968

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...