Lucene search
+L

4322 matches found

Kitploit
Kitploit
โ€ขadded 2026/09/12 8:29 p.m.โ€ข11 views

CVE-2026-2002-poc

Sumary The Forminator Forms โ€“ Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

4.4CVSS5.8AI score0.00166EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/12 12:10 p.m.โ€ข7 views

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

7.2CVSS6AI score0.01019EPSS
SaveExploits2References1
Kitploit
Kitploit
โ€ขadded 2026/09/12 12:03 p.m.โ€ข6 views

CVE-2017-0213-

CVE-2017-0213 to get privilege Administator from CMD Vulnerable Product| Version| Update| Tested ---|---|---|--- Windows 10| | | โˆš Windows 10| 1511| | Windows 10| 1607| | Windows 10| 1703| | โˆš Windows 7| | SP1| โˆš Windows 8.1| | | Windows RT 8.1| | | Windows Server 2008| | SP2| Windows Server 2008...

7.3CVSS6.8AI score0.84138EPSS
SaveExploits14
Kitploit
Kitploit
โ€ขadded 2026/09/12 5:55 a.m.โ€ข7 views

CVE-2025-7431

๊ฐœ๋… ์ฆ๋ช… โ€“ CVE-2025-7431 Knowledge Base = 2.3.1 - ์ธ์ฆ๋œ ๊ด€๋ฆฌ์ž+ ์ €์žฅํ˜• ํฌ๋กœ์Šค ์‚ฌ์ดํŠธ ์Šคํฌ๋ฆฝํŒ… ํ”Œ๋Ÿฌ๊ทธ์ธ ์Šฌ๋Ÿฌ๊ทธ ๊ฒฝ์œ  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N ------- 4.4 ์ทจ์•ฝ์  ๊ฐœ์š” ์ธ์ฆ๋œ ๊ณต๊ฒฉ์ž๊ด€๋ฆฌ์ž๋Š” WordPress์šฉ Knowledge Base ํ”Œ๋Ÿฌ๊ทธ์ธ์˜ ์„ค์ •์— ์•…์„ฑ ์ˆ์ฝ”๋“œ ์ฝ˜ํ…์ธ ๋ฅผ ์ฃผ์ž…ํ•˜์—ฌ ์ €์žฅํ˜• ํฌ๋กœ์Šค ์‚ฌ์ดํŠธ ์Šคํฌ๋ฆฝํŒ…XSS ์ทจ์•ฝ์ ์„ ์•…์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์žฌํ˜„ ๋‹จ๊ณ„ 1. ํ…Œ์Šคํ„ฐ๊ฐ€ ๋‹ค์Œ ๊ฒฝ๋กœ๋กœ ์ด๋™ํ•ฉ๋‹ˆ๋‹ค: root@kitploit:...

4.4CVSS5.9AI score0.00261EPSS
SaveExploits0
Nuclei
Nuclei
โ€ขadded 2026/09/12 2:04 a.m.โ€ข39 views

Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation

The Masteriyo LMS โ€“ eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateloggedinuser function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers t...

9.8CVSS7.8AI score0.02094EPSS
SaveExploits1References4
Nuclei
Nuclei
โ€ขadded 2026/09/12 2:04 a.m.โ€ข26 views

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

10CVSS7.9AI score0.08975EPSS
SaveExploits2References3
Nuclei
Nuclei
โ€ขadded 2026/09/12 2:04 a.m.โ€ข24 views

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

8.8CVSS5.9AI score0.02063EPSS
SaveExploits4References2
EUVD
EUVD
โ€ขadded 2026/09/11 6:00 a.m.โ€ข10 views

EUVD-2025-210888

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

3.5CVSS0.00142EPSS
SaveExploits0References1
Kitploit
Kitploit
โ€ขadded 2026/09/11 2:59 a.m.โ€ข5 views

CVE-2026-22241

๐Ÿšจ CVE-2026-22241 - Open eClass Theme Import Remote Code Execution ๐Ÿ“Œ Vulnerability Summary Open eClass also known as GUnet eClass, a widely used open-source Learning Management System LMS, contains a critical Unrestricted File Upload vulnerability in its Theme Import feature. An authenticated...

8.6CVSS5.9AI score0.03311EPSS
SaveExploits3References1
Kitploit
Kitploit
โ€ขadded 2026/09/10 11:55 p.m.โ€ข5 views

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Autor: Byte Reaper Descripciรณn CVE-2025-10046 es una vulnerabilidad de inyecciรณn SQL en el plugin ELEX WooCommerce Google Shopping Product Feed para WordPress, versiones 1.4.3 y anteriores. El problema se encuentra en el archivo...

4.9CVSS6AI score0.00714EPSS
SaveExploits2
Kitploit
Kitploit
โ€ขadded 2026/09/10 8:17 p.m.โ€ข5 views

vcenter_saml_login

vCenter SAML ๋กœ๊ทธ์ธ ๋„๊ตฌ vCenter ๋ฐฑ์—…์—์„œ IdPIdentity Provider ์ธ์ฆ์„œ๋ฅผ ์ถ”์ถœํ•˜๊ณ  Administrator๋กœ ๋กœ๊ทธ์ธํ•˜๊ธฐ ์œ„ํ•œ ๋„๊ตฌ ๋ฐฐ๊ฒฝ ์ผ๋ฐ˜์ ์œผ๋กœ ์—”์ง€๋‹ˆ์–ด๋ง ์ง„ํ–‰ ์ค‘ ํŒŒ์ผ ์„œ๋ฒ„์— ์žˆ๋Š” vCenter ๋ฐฑ์—…์— ์ ‘๊ทผํ•˜๊ฑฐ๋‚˜ ์ตœ๊ทผ CVE๋ฅผ ํ†ตํ•ด VCSA ํ˜ธ์ŠคํŠธ์˜ root ๊ถŒํ•œ์„ ํš๋“ํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. vCenter vSphere UI์— ๋กœ๊ทธ์ธํ•˜๋ฉด ๋” ๋งŽ์€ ์‹œ์Šคํ…œ๊ณผ ๊ธฐ๋ฐ€ ์ •๋ณด์— ์‰ฝ๊ฒŒ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์„ ๋ฟ๋งŒ ์•„๋‹ˆ๋ผ ๊ณ ๊ฐ์—๊ฒŒ ์ด๋Ÿฌํ•œ ๋ฐœ๊ฒฌ์˜ ์˜ํ–ฅ์„ ๋ณด์—ฌ์ค„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. data.mdb ํŒŒ์ผ์—๋Š” ์ธ์ฆ์„œ๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์œผ๋ฉฐ...

6AI score
SaveExploits0
Cvelist
Cvelist
โ€ขadded 2026/09/10 12:00 a.m.โ€ข29 views

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

0.00194EPSS
SaveExploits1References1
Cvelist
Cvelist
โ€ขadded 2026/09/09 4:06 p.m.โ€ข32 views

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

9.3CVSS0.005EPSS
SaveExploits0References3
Patchstack
Patchstack
โ€ขadded 2026/09/09 3:19 p.m.โ€ข8 views

WordPress WP BackItUp Community Edition plugin <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Nikola Kojic in WordPress Plugin WP BackItUp versions = 2.1.0...

4.9CVSS0.00746EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
โ€ขadded 2026/09/09 2:50 p.m.โ€ข29 views

CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

8.6CVSS0.00456EPSS
SaveExploits0References2
OSV
OSV
โ€ขadded 2026/09/09 8:28 a.m.โ€ข19 views

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method โ€” registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

8.8CVSS5.8AI score
SaveExploits0References13
NVD
NVD
โ€ขadded 2026/09/09 8:17 a.m.โ€ข5 views

CVE-2026-19778

The WPMR Google Feed Manager for WooCommerce โ€“ Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

6.5CVSS0.00269EPSS
SaveExploits0References6
EUVD
EUVD
โ€ขadded 2026/09/09 6:00 a.m.โ€ข5 views

EUVD-2026-74715

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

4.1CVSS0.00186EPSS
SaveExploits0References1
NVD
NVD
โ€ขadded 2026/09/09 4:17 a.m.โ€ข5 views

CVE-2026-19800

The Mail Mint โ€“ Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

4.9CVSS0.00316EPSS
SaveExploits0References8
EUVD
EUVD
โ€ขadded 2026/09/09 3:28 a.m.โ€ข7 views

EUVD-2026-74608

The Ninja Forms โ€“ The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

6.6CVSS0.00679EPSS
SaveExploits0References10
Rows per page
Query Builder