subfinder-action

SubFinder Action يجعل من السهل تنسيق SubFinder مع GitHub Action. مثال الاستخدام إجراء GitHub Action لتشغيلSubFinder لنطاق واحد - name: 🔎 SubFinder - DNS Enumeration uses: projectdiscovery/subfinder-action@main with: domain: projectdiscovery.io إجراء GitHub Action لتشغيلSubFinder لنطاقات متعددة -...

WordPress Advanced Form Integration plugin <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability

Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability discovered by wachiss - Datafarm Co., Ltd. in WordPress Plugin Advanced Form Integration versions = 2.9.0...

study-turbolinks-link

استخدام JavaScript https://github.com/turbolinks/turbolinksapi-reference Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...

CVE-2018-11776

CVE-2018-11776 في 23 أغسطس 2018، أصدرت Apache Strust2 أحدث نشرة أمنية، حيث توجد ثغرة عالية الخطورة لتنفيذ الأكواد عن بُعد في Apache Struts2، وقد تم الإبلاغ عن الثغرة من قبل باحث أمني من فريق Semmle Security Research، ورقم الثغرة هو CVE-2018-11776 S2-057. إذا لم يتم تعيين قيمة namespace في تكوين X...

CVE-2026-87846

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

CVE-2026-87846

The Shipping for Nova Poshta WordPress plugin (versions 1.18.7 through 1.19.8 ) contains a vulnerability where an AJAX action lacks authorization, nonce, or ownership checks. This allows unauthenticated users to delete shipment records for arbitrary orders. Additionally, attackers can force the s...

CVE-2021-26084

CVE-2021-26084 نطاق التأثير الإصدار 6.13.23 6.14.0 ≤ الإصدار 7.4.11 7.5.0 ≤ الإصدار 7.11.6 7.12.0 ≤ الإصدار 7.12.5 السبب وطريقة الاستغلال يستخدم Confluence إطارًا لربط عناوين URL بفئات Java، مما ينتج ما يُسمى بـ "الإجراء". تنتهي عناوين URL الخاصة بالإجراءات بـ ".action" ويتم تعريفها في ملف...

CVE-2023-37598

CVE-2023-37598 — issabel-pbx 4.0.0-6 : Contrefaçon de requête intersite CSRF Aperçu Identifiant CVE : CVE-2023-37598 Type de vulnérabilité : Contrefaçon de requête intersite CSRF Produit concerné : issabel-pbx v4.0.0-6 Sévérité : Moyenne Découverte par : Sahil Ojha Date de divulgation : 10/07/202...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description Le plugin Error Log Viewer By WP Guru pour WordPress est vulnérable à une lecture arbitraire de fichier dans toutes les versions jusqu'à la version 1.0.1.3 incluse, via l'action AJAX wpajaxnoprivelvwplogdownload. Cela permet à des attaquants non authentifiés de li...

js-jobs

js-jobs JS Job Manager P...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page input type="hidden" name="nonce" value="90cc73ad2...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Autorisation manquante permettant une lecture arbitraire de fichiers sans authentification Description Le plugin Error Log Viewer By WP Guru pour WordPress est vulnérable à une lecture arbitraire de fichiers dans toutes les versions jusqu'à...

CVE-2015-10034

CVE-2015-10034 تم إنشاء هذا المستودع لتوضيح إجراء J-TAS Action. يحتوي المجلد workout-organizer-2aaedb7f69ea398a0217493fefe8f19b31ee0775 على التطبيق الضعيف المرتبط بـ CVE-2015-10034. لقد قمنا بتضمين ملف SARIF مع نتائج التحليل الذي أجراه إجراء J-TAS...

gato

!WARNING This repository is deprecated and archived Gato has been superseded by Trajan , Praetorian's multi-platform CI/CD vulnerability detection and attack automation tool. Trajan consolidates GitHub Actions Gato and GitLab Glato CI/CD attack capabilities into a single, actively-maintained...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

PT-2026-108766

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf idr delete index function fails to properly validate lookup results. When tcf action delete drops a reference, an unlocked...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus مشترك مصادق → مدير عبر إجراء AJAXdo-reinstall 〔 1 〕 الثغرة | ---|--- CVE| CVE-2025-14364 CVSS v3.1| 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence الإضافة| Demo Importer Plus الإصدارات المتأثرة| جميع الإصدارات ≤ 2.0.8 التفويض المطلوب| مشتر...

CVE-2026-97147

A flaw was found in OpenStack Mistral. Due to a missing authorization check in the action definition and environment update paths, an authenticated user can modify or overwrite another project's publicly-scoped action definitions and environments. An attacker with a valid account in any project c...