112 matches found
Wordpress-XMLRPC-Brute-Force-Exploit
Exploit de fuerza bruta para Wordpress XMLRPC System Multicall por 1N3 Última actualización: 20170215 https://crowdshield.com ACERCA DE: Este es un exploit para la función System Multicall de xmlrpc.php de Wordpress que afecta a la versión más reciente de Wordpress 3.5.1. El exploit funciona...
CVE-2025-9978: Improper Neutralization of Input During Web Page Generation
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability...
EUVD-2007-3132
Malware in sbrugna...
CVE-2025-9703: Undefined Security Weakness
The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability...
CVE-2025-9487: Undefined Security Weakness
The Admin and Site Enhancements ASE WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads...
Nextcloud: xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.
The xmlrpc.php and wp-cron.php files were found to be enabled on the target website, which could allow attackers to perform denial of service attacks. Username enumeration via the RSS generator identified several valid usernames. The xmlrpc.php file could be used to cause a DDOS attack by sending...
Remote code execution
A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...
CVE-2023-43187: XML Injection (aka Blind XPath Injection)
A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests...
Top Echelon Software: xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)
xmlrpc.php was enabled even though we did not make use of any of its functionality - it is now disabled...
MTN Group: Wordpress users disclosure from json and xml file
Summary: It's possible to get information about the users registered such as: username without authentication in Wordpress via API on: https://www.mtn.co.sz/wp-json/oembed/1.0/embed?url=https://www.mtn.co.sz/&format=json https://www.mtn.co.sz/author-sitemap.xml Steps To Reproduce: The path...
Showmax: xmlrpc.php is publicly available at https://stories.showmax.com/xmlrpc.php
Summary: Greetings @Showmax, i found an xmlrpc.php file on https://stories.showmax.com, it's publicly available and it accepts POST requests. Description: your site is a WordPress site based, xmlrpc.php is a file that is intended to make API calls between hosts, if it's enabled on a WordPress sit...
BlockDev Sp. Z o.o: xmlrpc.php FILE IS enabled it will used for Bruteforce attack and Denial of Service(DoS)
xmlrpc.php file is visible...
MTN Group: [play.mtn.co.za] Application level DoS via xmlrpc.php
Description Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DOS/SSRF. The website play.mtn.co.za has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. hackeron...
U.S. Dept Of Defense: xmlrpc.php FILE IS enable which enables attacker to XSPA Brute-force and even Denial of Service(DOS), in https://████/xmlrpc.php
Summary: Hello team, I have found a security vulnerability inhttps://███████/xmlrpc.php which lets attacker to: 1: XSPA or PortScan 2: Bruteforce 3:DOS and much more Description: Impact Step-by-step Reproduction Instructions █████████ 1: Go to https://██████/xmlrpc.php to check if it is enabled o...
BlockDev Sp. Z o.o: xmlrpc.php FILE IS enable it will used for Bruteforce attack
xmlrpc.php FILE IS enable it will used for Bruteforce attack...
Ian Dunn: xmlrpc.php FILE IS enable it can be used for conducting a Bruteforce attack and Denial of Service(DoS)
Hi Team, The website https://www.iandunn.name has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. URL:...
WordPress Core xmlrpc.php Denial of Service Vulnerability
WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A denial of service vulnerability exists in WordPress Core xmlrpc.php. An attacker can exploit the vulnerability to launch a denial of servi...
WordPress Core 5.3.x - xmlrpc.php Denial of Service
WordPress Core 5.3.x - xmlrpc.php Denial of Service !/usr/bin/env python WordPress methodNamepingback.ping" entry += f"paramspingback/COUNT" entry += f"paramspingback/uuid.uuid4" entry += f"target/?p=1" entry += f"target/e" taxes DB more return entry def buildrequestpingback,target,entries: prefi...
WordPress Core < 5.3.x - 'xmlrpc.php' Denial of Service
!/usr/bin/env python WordPress methodNamepingback.ping" entry += f"paramspingback/COUNT" entry += f"paramspingback/uuid.uuid4" entry += f"target/?p=1" entry += f"target/e" taxes DB more return entry def buildrequestpingback,target,entries: prefix = "system.multicall" suffix = "" request = prefix...
Nord Security: xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)
Hi Team, The website https://www.nordvpn.com has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. URL:...