EUVD-2026-88070

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2026-23550

🧨 CVE-2026-23550 – Bypass de administración de Modular Connector Inicio de sesión de administrador de WordPress no autenticado mediante el parámetroorigin=mo Plugin Modular Connector ≤ 2.5.1 📖 Descripción El plugin Modular Connector para WordPress versiones ≤ 2.5.1 contiene una vulnerabilidad...

CVE-2026-63030

LANGZ — wp2shell Exploit Tool Author: LANGZ CVE: CVE-2026-63030 Chained with CVE-2026-60137 Severity: Critical CVSS 9.8 Type: Pre-Authentication Remote Code Execution RCE ⚠️ Disclaimer This tool is provided strictly for educational purposes and authorized security testing only. By using this tool,...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

westone-CVE-2020-17519-scanner

westone-CVE-2020-17519-scanner Apache Flink 1.11.0、1.11.1、1.11.2 Hackers can read/write remote files via REST API Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-17519-scanner.git cd westone-CVE-2020-17519-scanner cmd CVE-2020-17519.exe...

CVE-2022-1388

CVE-2022-1388 https://support.f5.com/csp/article/K23605346 This vulnerability may allow an unauthenticated attacker to gain network access to BIG-IP systems through the management port and/or their own IP addresses to execute arbitrary system commands, create or delete files, or disable services...

CVE-2021-22986

CVE-2021-22986 This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only...

CVE-2026-100903: Missing Authentication for Critical Function

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

CVE-2025-43990-Magento-RCE

Magento APSB25-94 — Unauthenticated File Upload to RCE Overview Exploits unauthenticated file upload in Magento / Adobe Commerce via REST API guest cart customoptions file upload. Attack Chain 1. GraphQL → leak product SKU 2. REST API → create guest cart 3. REST API → upload PNG polyshell via...

WP2Shell-Scanner

WP2Shell Scanner A command line tool that checks whether a WordPress site is exposed to WP2Shell CVE-2026-63030 and CVE-2026-60137. It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything. !WARNING For authorised testing only...

CVE-2026-9830

CVE-2026-9830 PoC de Evaluación de la API de BookingPress Pro Este repositorio contiene una prueba de concepto en Python para validar una exposición no autenticada reportada en la API REST de BookingPress Pro. Una respuesta exitosa puede contener información de reservas y clientes, que puede...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Technical Analysis & Laboratory Exploitation of Null-Byte Argument Injection Vulnerability Summary CVE-2022-36804 is a high/critical Argument Injection vulnerability within the REST API of Atlassian Bitbucket Server and Data Center. While the...

struts-s2-052-deserialization-rce-lab

Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — WordPress Privilege Escalation Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin. 📌 Summary CVE-2023-28121 allows creating administrator users without authentication via the REST API. Severity: Critical CVSS 9.8 Impact: Full...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

spring-data-rest-CVE-2017-8046

image:https://spring.io/badges/spring-data-rest/ga.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" image:https://spring.io/badges/spring-data-rest/snapshot.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" = Spring Data REST The...