CVE-2024-12404

CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Unauthenticated SQL Injection Description The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user...

EUVD-2026-91178

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

CVE-2026-92174 SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

EUVD-2026-91174

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...

CVE-2024-55976

CVE-2024-55976 Critical Site Intel = 5.6 AND error-based - WHERE, HAVING,...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

parameth

parameth Esta herramienta se puede usar para descubrir por fuerza bruta parámetros GET y POST A menudo, cuando estás explorando un directorio en busca de archivos comunes, puedes identificar scripts por ejemplo test.php que parecen necesitar un parámetro desconocido. Con suerte, esto puede ayudar...

parameth

parameth This tool can be used to brute discover GET and POST parameters Often when you are busting a directory for common files, you can identify scripts for example test.php that look like they need to be passed an unknown parameter. This hopefully can help find them. example scan The -off flag...

CVE-2025-60787-MotionEye-RCE

CVE-2025-60787: Motioneye - Ejecución Remota de Código RCE Prueba de concepto PoC profesional para CVE-2025-60787, una vulnerabilidad crítica de Ejecución Remota de Código RCE en MotionEye versiones ≤ 0.43.1b4. Resumen Técnico La vulnerabilidad surge de un bypass de validación del lado del client...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Magnus Billing v7 명령 주입 PoC 인증되지 않은 명령 주입 취약점이 Magnus Billing v7.3.0에 존재합니다. icepay.php의 democ GET 매개변수가 삭제 없이 셸 함수에 직접 전달되어 웹 서버 사용자 권한으로 임의 명령 실행이 가능합니다. 주입은 블라인드입니다 — 출력이 HTTP 응답에 반영되지 않습니다 — 따라서 이 익스플로잇은 각 명령의 출력을 웹루트의 파일로 리다이렉트하고 HTTP를 통해 다시 가져옵니다. 작동 방식 1...

CVE-2023-1454-EXP

JeecgBoot SQL（CVE-2023-1454）exp 1. Detalles de la vulnerabilidad La versión jeecg-boot 3.5.0 tiene una vulnerabilidad de inyección SQL. Esta vulnerabilidad se origina por un problema de seguridad en el archivo jmreport/qurestSql, que provoca inyección SQL a través del parámetro apiSelectId. 2...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: 반사형 교차 사이트 스크립팅 XSS 개요 CVE-2023-34837 은 Microworld Technologies eScan Management Console 버전 14.0.1400.2281에서 발견된 반사형 교차 사이트 스크립팅Reflected Cross-Site Scripting, XSS 취약점입니다. 이 취약점은 Unmanaged Computers → Network Computers 기능의 GrpPath POST 매개변수에 존재합니다. 사용자가...

CVE-2023-34632

CVE-2023-34632 XSS reflejado en 1000projects Book Management System 1.0 CVE-2023-34632 Cross-Site Scripting XSS reflejado en 1000projects Book Management System 1.0 Descripción Se descubrió una vulnerabilidad de Cross-Site Scripting XSS reflejado en 1000projects Book Management System versión 1.0...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Project Description CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS versions 2.9.1 that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password...

CVE-2026-6356

Augmentt: Escalada de privilegios mediante manipulación de parámetros Créditos Este CVE fue un esfuerzo colaborativo entre: HelloWorld Autor – GitHub: https://github.com/Penquinsecq Raznov – GitHub: https://github.com/basraznov Descripción Una vulnerabilidad en la aplicación web permite a los...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...