MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

Layer5 Meshery 0.5.2 - SQL Injection

Layer5 Meshery 0.5.2 contains a SQL injection vulnerability in the REST API that allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint order parameter in GetMesheryPatterns in models/mesherypatternpersister.go. id: CVE-2021-31856 info: name: Layer5 Meshe...

WP Cerber < 8.9.3 - Broken Access Control

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints. The exploit requires sending a request with a trailing '?'. id: CVE-2021-37598 info: name: WP Cerber 8.9.3 - Broken...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

OptinMonster Plugin < 2.6.5 - Unprotected REST-API

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the loggedinorhasapikey function in the /OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

WPAdverts <= 2.3.2 - Information Disclosure

WPAdverts – Classifieds Plugin for WordPress = 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication. id:...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei 템플릿: CVE-2022-1598.yaml 비디오 PoC: https://www.youtube.com/watch?v=MbhiQKWvivQ 참고 자료: https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...

Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed

Nuclei テンプレート CVE-2022-1388 BIG-IP iControl REST 露出 2022年5月6日 これは認証エンドポイントにアクセスしてAPIの存在を確認するだけです この脆弱性により、管理ポートやセルフIPアドレスを介してBIG-IPシステムにネットワークアクセス可能な認証されていない攻撃者が、任意のシステムコマンドを実行したり、ファイルを作成・削除したり、サービスを無効化したりする可能性があります。データプレーンへの影響はなく、これはコントロールプレーンの問題のみです。 このテンプレートは簡単なチェックです リクエストを送信: path...

wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 익스플로잇 📌 개요 이 저장소는 WordPress 플러그인 Really Simple SSL의 취약점인 CVE-2024-10924에 대한 PoCProof-of-Concept 익스플로잇을 포함합니다. 이 취약점은 2FA2단계 인증를 우회할 수 있게 합니다. 공격자는 이 결함을 악용하여 유효한 ID를 가진 모든 사용자로 로그인할 수 있습니다. 🚨 경고: 이 익스플로잇은 교육 및 연구 목적으로만 제공됩니다. 소유하지 않은 시스템에 대한 무단 사용은 불법입니다. 🚀 익스플로잇 사용법 사전 요...

CVE-2026-49772

The Events Calendar SQL 인젝션 CVE-2026-49772 PoC 설명 CVE-2026-49772는 WordPress 플러그인 The Events Calendar 의 인증되지 않은 블라인드 SQL 인젝션 입니다. 손상된 REST 매개변수 검증기validatecallback이 검증 대신 클로저를 반환로 인해 실험적 tec/v1 REST API의 order 매개변수가 SQL ORDER BY 절에 검증되지 않은 채 도달합니다: GET /wp-json/tec/v1/events?orderby=eventdate&orde...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Java 安全でないデシリアライゼーションラボ 安全でないデシリアライゼーションに対して脆弱な基本的なJava RESTアプリケーションで、RCEにつながります。 プロジェクトはJava 8u45 で実行する必要があります。 以下の依存関係を持つMavenベース： jackson-databind 2.2.2 commons-collections 3.1 spring-context-support 4.3.11 さらにガジェットを試したい場合は、Mavenを通じて依存関係を追加できます。 実行方法 （Intellij...