CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / 익스플로잇 스크립트: CVE-2026-2631.py 작성자: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub 연락처: Telegram: @Kxploit 🧬 취약점 개요 플러그인: Datalogics Ecommerce Delivery – Datalogics WordPress 영향받는 버전: 2.6.60 제외 취약점 유형: 인증되지 않은 권한 상승 CVE: CVE-2026-2631...

CVE-2019-16097

CVE-2019-16097-batch 면책 조항 보안 연구 목적으로만 사용하며, 불법 테스트에 사용하지 마십시오. 결과에 대한 책임은 본인에게 있습니다!!! CVE-2019-16097-batch 대량 취약점 활용 스크립트 url.txt 파일에 대량으로 대상 주소를 추가하세요 http://1.1.1.1 http://2.2.2.2 python으로 이 스크립트를 실행하면 result.txt에서 최종 검증 결과를 확인할 수 있습니다 취약점 배경 최근 이미지 레지스트리 Harbor에서 임의 관리자 등록 취약점이 발견되었습니다. 공격자는...

CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

CVE-2019-16097-batch

CVE-2019-16097-batch 면책 조항 보안 연구 목적으로만 사용해야 하며, 불법 테스트를 해서는 안 됩니다. 그로 인한 결과는 본인이 책임지셔야 합니다!!! CVE-2019-16097-batch 배치 취약점 익스플로잇 스크립트 url.txt 파일에 대상 주소를 대량으로 추가하세요. http://1.1.1.1 http://2.2.2.2 python으로 이 스크립트를 실행하면 result.txt에서 최종 검증 결과를 확인할 수 있습니다. 취약점 배경 최근 이미지 저장소 Harbor에서 임의 관리자 등록 취약점이...

CVE-2026-5118

Divi Form Builder ⚠️ 경고: 이 도구는 공인된 침투 테스트 및 보안 연구용입니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 소유권이 있거나 명시적인 서면 허가를 받은 시스템에서만 사용하십시오. 추가 면책 조항: Jenderal92의 표지에서 면책 조항을 확인할 수 있습니다. 여기서 확인하세요 !!! 개요 이 Python 2 스크립트는 Divi WordPress 플러그인및 관련 Divi 양식의 권한 상승 취약점을 악용합니다. 다음 방법을 통해 원격으로 관리자 계정을 등록할 수 있습니다: 대상의 Divi 등록...

CVE-2026-77915 rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2026-77915 rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2026-77915 rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2019-25738

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hcajaxsaveoption action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to...

CVE-2019-25738 WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hcajaxsaveoption action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to...

CVE-2026-7284

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyelhandleregister' function not restricting what user roles a user can register with...

Exploit for CVE-2025-39459

📄 Nuclei Template for CVE-2025-39459 🚀 Overview This repo...

CVE-2026-3406

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible to launch the attack...

EUVD-2026-9139

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible to launch the attack...

Projectworlds Online Art Gallery Shop SQL注入漏洞

Projectworlds Online Art Gallery Shop is an online art gallery store open sourced by Projectworlds. Version 1.0 of Projectworlds Online Art Gallery Shop has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter fname in the file admin/registration.php,...

CVE-2025-12981

The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the userrole parameter. This makes it possible...

PT-2026-20600

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza lms pro register user front end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated...

CVE-2026-1937 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the yaymailimportstate AJAX action in all versions up to, and including, 4.3.2. This makes it possible for...

VulnCheck KEV: CVE-2024-12213

The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable...

PT-2026-1752

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions through 3.28.25 Description The Frontend Admin by DynamiApps plugin for WordPress has a flaw that allows unauthenticated attackers to register as administrators and gain complete control of a site. This is...