CVE-2026-96661

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection in all versions up to and including 1.25.1 . The root cause is insufficient escaping of the 'gmedia__in' parameter and a lack of proper preparation on existing SQL queries. This vulnerability allows unauthenti...

CVE-2026-104800

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 1.0 . The flaw exists in the standalone admin.php endpoint, which lacks authentication, capability checks, and nonce verification. Specifically, the plugin fails to sanitize POST par...

CVE-2026-104800 AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width and height' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.5 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data...

ThreatIntel-Aggregator

Threat Intel Aggregator A self-hosted threat intelligence platform that aggregates RSS feeds from 60+ security vendors, runs AI triage, correlates findings against your RunZero asset inventory, and surfaces actionable alerts through a dark-mode web dashboard. Built to run standalone with zero clo...

CVE-2026-103422

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2024-10924

CVE-2024-10924 - Authentication Bypass in Really Simple Security OVERVIEW This project demonstrates the exploitation and mitigation of CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress "Really Simple Security" plugin. STEP 1: ENVIRONMENT SETUP Start the vulnerable...

TheMisfits-CVE-2024-8465-SQLi

CVE-2024-8465 – SQL Injection Proof of Concept Team Information Team Name: The Misfits Team Members: Muhammad Tayyab Nisar Oluwasola SAMUEL Abubakar Mohamed Melek Balghouthi Overview This repository contains a vulnerable web application created as a Proof of Concept PoC to demonstrate an SQL...

cve-2025-54988-VulnTikaProject

Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

EUVD-2026-100779

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422

The AnyComment plugin for WordPress (versions up to and including 0.3.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and a lack of output escaping in the AnyCommentSubscripti...

CVE-2026-93388

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

CVE-2026-17092

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-103423

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally...

evillimiter-ng

Evil Limiter Next Generation Software-blue A tool to monitor, analyze and limit the bandwidth upload/download of devices on your local network without physical or administrative access. evillimiter-ng employs ARP spoofing and traffic shaping to throttle the bandwidth of hosts on the network. New ...

Oihk-pentesting

OIHK-pentesting OIHK-pentesting is an autonomous multi-agent engine for authorized security assessments. A root planner delegates to recon, discovery, attack Privesc, validation, and reporting agents — and the engine itself enforces scope, egress, evidence, and resource policy no matter which mod...

Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. i...