simplewall

simplewall Definitely for advanced users. Description: Simple tool to configure Windows Filtering Platform WFP which can configure network activity on your computer. The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems. You can...

CVE-2026-13764 Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2026-13764

The Masterstudy - Education WordPress Theme for WordPress (versions up to and including 4.8.151 ) is vulnerable to Privilege Escalation due to missing authorization and nonce validation on the masterstudy_ms_stm_set_discard_transient AJAX action. This flaw allows authenticated attackers with Subs...

EUVD-2026-124350

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the masterstudymsstmsetdiscardtransient AJAX action. This makes it possible for...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

WordPress WP Remote Users Sync plugin < 2.3.0 - Privilege Escalation to Administrator vulnerability

Privilege Escalation to Administrator vulnerability discovered by Turan Dadashzada in WordPress Plugin WP Remote Users Sync versions 2.3.0...

CVE-2026-123092

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-122003

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and...

CVE-2026-123092 WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-122003

The Abilities Bridge WordPress plugin (versions prior to 1.4.2 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists because the plugin fails to require a valid nonce when re-authenticating a REST API request from a logged-in session cookie. An attacker can trick a logged...

EUVD-2026-124280

The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to...

CVE-2026-122003 Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and...

WordPress Abilities Bridge plugin < 1.4.2 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Abilities Bridge versions 1.4.2...

CVE-2026-123092

The WP Remote Users Sync WordPress plugin, in versions prior to 2.3.0 , is vulnerable to privilege escalation. The flaw exists because the plugin fails to restrict which user metadata keys can be written during incoming user synchronisation requests. An attacker who possesses the shared synchroni...

cve-2022-24644

CVE-2022-24644 ZZ Inc. KeyMouse 3.08 Windows Unauthenticated Update Remote Code Execution Vulnerability Usage: python3 cve-2022-24644poc.py Details in the report at gerr.re. Steps to reproduce 1. Install KeyMouse Windows 3.08; 2. Set spoof www.keymouse.com to our attacker ip; For the...

CVE-2023-30459

CVE-2023-30459 SmartPTT SCADA 1.1.0.0 allows remote code execution when the attacker has administrator privileges by writing a malicious C script and executing it on the server via server settings in the administrator control panel on port 8101, by default. How to use: python CVE-2023-30459.py -t...

JFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope Bypass

JFrog Artifactory Self-Hosted can disclose an anonymous token through the trailing-slash AWS token endpoint CVE-2026-42018, and affected releases can use that token to issue an administrator-scoped token without enforcing its scope CVE-2026-42016. id: CVE-2026-42016 info: name: JFrog Artifactory ...

Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection

Craft CMS 4.18.9, 5.11.2 contain an unauthenticated SQL injection caused by unsanitized concatenation of the attribute parameter in the element search endpoint, letting remote attackers read and write the database to gain administrator access, exploit requires no authentication. id: CVE-2026-1234...

CVE-2026-22241

🚨 CVE-2026-22241 - Open eClass Theme Import Remote Code Execution 📌 Vulnerability Summary Open eClass also known as GUnet eClass, a widely used open-source Learning Management System LMS, contains a critical Unrestricted File Upload vulnerability in its Theme Import feature. An authenticated...