2004 matches found
FreePBX-SQLi-RCE
FreePBX CVE-2025-57819 - Unauthenticated SQLi to RCE PoC Educational & Security Research Only - See Legal Notice Below Exploitation proof of concept for CVE-2025-57819, a critical unauthenticated SQL injection vulnerability in FreePBX that allows remote code execution. This PoC is published after...
CVE-2023-30092
CVE-2023-30092 All Details about CVE-2023-30092 Software: Online Pizza Ordering System 1.0 Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Vulnerability Type: SQL Injection Affected Component: QTY Parameter Impact Denial of Service:...
0-click-RCE-Exploit-for-CVE-2024-51793
CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...
ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection
ClipBucket v5.5.2-187 and below contain a blind SQL injection caused by unsanitized objid parameter in /actions/ajax.php used in userexists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request. id: CVE-2026-21875 info: name: ClipBucket v5 = 5.5.2...
CandidATS 3.0.0 - Cross-Site Scripting.
CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortBy parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...
CVE-2024-52430
CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...
CVE-2026-18143
CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...
CVE-2026-54597
CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...
CVE-2026-27540
🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...
CVE-2026-89055
CVE-2026-89055 — Customer Reviews for WooCommerce CusRev Authorization Bypass Python 3 PoC for CVE-2026-89055 in Customer Reviews for WooCommerce customer-reviews-woocommerce / Ivole CusRev. Description PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 is vulnerab...
CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass
CVE-2026-1729 - AdForest WordPress 認証バイパス PoC 説明 CVE-2026-1729 PoC のシンプルな Proof of Concept - AdForest WordPress テーマの認証バイパス脆弱性。 著者: f3ds cr3w est 2oo2 blog 特徴 ✅ 認証なしで管理者アクセス ✅ 本番 WordPress 環境で動作 ✅ Docker のセットアップは不要 ✅ シンプルなコマンドラインインターフェース ✅ セッションの永続化 必要条件 Python 3.6+ requests ライブラリ インストール pip insta...
CVE-2024-3673
CVE-2024-3673 CVE-2024-3673 Exploit: Local File Inclusion in Web Directory Free WordPress Plugin before 1.7.3 Overview CVE-2024-3673 describes a critical vulnerability in the Web Directory Free WordPress plugin versions prior to 1.7.3. The plugin fails to validate a parameter before using it in a...
CVE-2024-6244
🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...
CVE-2024-33911
The School Management 10.3.4 - 認証後SQLインジェクション エクスプロイトタイトル: The School Management 10.3.4 - 認証後SQLインジェクション 日付: 2024年4月29日 エクスプロイト作者: Ivan Spiridonov xbz0n ベンダーホームページ: https://theschool-management.com バージョン: 10.3.4 テスト環境: Ubuntu 22.04 CVE: CVE-2024-33911 脆弱性 The School...
cve-2023-2523-and-cve-2023-2648
cve-2023-2523 Note: The script uploads a phpinfo file Usage: Results are automatically saved to result.txt Image Manual POC: POST /E-mobile/App/Ajax/ajax.php?action=mobileuploadsave HTTP/1.1 Host: your-ip Content-Length: 352 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: null...
CVE-2022-21661
WordPress CVE-2022-21661 Scanner Usage python wordpressscanner.py -H -p -ssl -proxy -path Help WordPress Scanner for CVE-2022-21661 options: -h, --help show this help message and exit -H HOST, --host HOST Host or IP address -p PORT, --port PORT Port number -ssl, --sslsupport Support SSL/TLS -prox...
cve-2025-1323
cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies: pip instal...
SQL-Injection-and-RCE_CVE-2025-57819
FreePBX RCE PoC Unauthenticated Summary FreePBX versions 15, 16, and 17 contain a Remote Code Execution RCE vulnerability caused by insufficient sanitization of user-supplied data in endpoints. An unauthenticated attacker can manipulate the database and achieve remote code execution. Exploit...
CVE-2026-84279
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
