EUVD-2026-91178

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

EUVD-2026-91174

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...

CVE-2024-55976

CVE-2024-55976 Critical Site Intel = 1.0 - Неаутентифицированная SQL-инъекция Описание Плагин Critical Site Intel для WordPress уязвим к SQL-инъекциям в версиях до 1.0 включительно из-за недостаточного экранирования пользовательского параметра и отсутствия достаточной подготовки существующего...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: отражённый межсайтовый скриптинг XSS Оглавление Обзор Детали уязвимости Затронутый продукт Технический анализ Доказательство концепции шаги воспроизведения Воздействие Смягчение и устранение Ссылки Отказ от ответственности Обзор В Microworld Technologies...

parameth

parameth This tool can be used to brute discover GET and POST parameters Often when you are busting a directory for common files, you can identify scripts for example test.php that look like they need to be passed an unknown parameter. This hopefully can help find them. example scan The -off flag...

parameth

parameth Cet outil peut être utilisé pour découvrir par force brute les paramètres GET et POST Souvent, lorsque vous explorez un répertoire à la recherche de fichiers courants, vous pouvez identifier des scripts par exemple test.php qui semblent nécessiter qu'un paramètre inconnu leur soit...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye - Exécution de code à distance RCE Preuve de concept PoC professionnelle pour CVE-2025-60787, une vulnérabilité critique d'exécution de code à distance RCE dans MotionEye versions ≤ 0.43.1b4. Aperçu technique La vulnérabilité provient d'un contournement de validation côt...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Injection de commande dans Magnus Billing v7 PoC Vulnérabilité d'injection de commande sans authentification dans Magnus Billing v7.3.0. Le paramètre GET democ dans icepay.php est passé directement à une fonction shell sans assainissement, permettant l'exécution arbitraire de...

CVE-2023-1454-EXP

JeecgBoot SQL CVE-2023-1454 exp 1. Описание уязвимости В версии 3.5.0 jeecg-boot существует уязвимость SQL-инъекции, которая возникает из-за проблем безопасности в файле jmreport/qurestSql. Через параметр apiSelectId происходит SQL-инъекция. 2. Использование python3 CVE-2023-1454.py optional...

SuperWebmailer 7.21.0.01526 - Remote Code Execution

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection. id: CVE-2020-11546 info: name: SuperWebmailer...

CVE-2023-34837

CVE-2023-34837 — Console de gestion eScan : Cross-Site Scripting réfléchi XSS Présentation CVE-2023-34837 est une vulnérabilité de Cross-Site Scripting réfléchi XSS découverte dans la Console de gestion eScan de Microworld Technologies version 14.0.1400.2281. La vulnérabilité réside dans le...

CVE-2023-34632

CVE-2023-34632 XSS Réfléchi dans 1000projects Book Management System 1.0 CVE-2023-34632 Cross-Site Scripting XSS Réfléchi dans 1000projects Book Management System 1.0 Description Une vulnérabilité de Cross-Site Scripting XSS réfléchi a été découverte dans 1000projects Book Management System versi...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Description du Projet CVE-2025-2304 est une vulnérabilité de Mass Assignment dans Camaleon CMS versions 2.9.1 qui permet à un utilisateur authentifié d'élever ses privilèges au rang d'administrateur en manipulant le paramètre rol...

CVE-2026-6356

Augmentt: повышение привилегий через подмену параметров Авторы Эта CVE была результатом совместной работы: HelloWorld Автор – GitHub: https://github.com/Penquinsecq Raznov – GitHub: https://github.com/basraznov Описание Уязвимость в веб-приложении позволяет обычным пользователям повышать свои...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...