Exploit-CVE-2023-22515

利用 CVE-2023-22515 一个用于 CVE-2023-22515 的简单 Bash 脚本漏洞利用工具。 信息 Confluence Data Center 和 Server 实例存在一个访问控制失效漏洞（CVE-2023-22515），允许攻击者创建未经授权的 Confluence 管理员账户并访问 Confluence 实例。 受影响版本 8.0.0 8.0.1 8.0.2 8.0.3 8.0.4 8.1.0 8.1.1 8.1.3 8.1.4 8.2.0 8.2.1 8.2.2 8.2.3 8.3.0 8.3.1 8.3.2 8.4.0 8.4.1 8.4.2 8.5.0...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core 插件 选项 示例： python CVE-2025-49388.py -u http://127.0.0.1/wordpress 主要选项： 选项| 描述| 示例 ---|---|--- -u, --url| 目标 WordPress URL（必填 ）| -u http://target.com/wordpress -un, --username| 所需的用户名（默认：随机生成）| -un admin1337 -fn, --fullname| 全名（默认：Nxploited）| -fn "John Doe"...

CVE-2019-16097

CVE-2019-16097 本程序只供安全研究使用，请勿用作非法！ 漏洞危害 可导致攻击者创建管理员账户，从而上传恶意镜像，导致使用该仓库的客户端被感染 漏洞组件 Harbor 影响版本 1.7.0-1.8.2 修复建议 尽快升级至1.7.6或1.8.3...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE Un PoC para CVE-2024-27956, una inyección SQL en el plugin ValvePress Automatic. Este PoC explota la vulnerabilidad creando un usuario en el objetivo y otorgando derechos de Administrador. Ser administrador en WordPress puede conducir a la ejecución remota de código. Uso g...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

monitorr-exploit-toolkit

Monitorr 漏洞利用工具包 RCE ：通过 不安全的文件上传 实现（PHP 反弹 Shell、Webshell 等） 管理员账户创建 ：通过 授权绕过 实现 技术信息泄露 ：Monitorr 版本、PHP 版本、系统版本与内核、PHP 配置等 针对 CVE-2020-28872 和 CVE-2020-28871 的漏洞利用。 PacketStorm 用法 $ ruby exploit.rb -h Monitorr-Exploit Usage: exploit.rb upload --debug exploit.rb create --debug exploit.rb version...

CVE-2026-100255

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

CVE-2026-100255

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...

CVE-2026-100255

The JetBrains TeamCity application versions prior to 2026.2 , 2026.1.4 , and 2025.11.8 are vulnerable to an administrator account takeover . The flaw occurs during the password reset process, potentially allowing an attacker to seize control of an administrator account. The CVSS 3.1 score is 8.1 ...

The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation

The Opal Estate Pro plugin ≤ 1.7.5 is vulnerable to privilege escalation. Due to missing role restrictions in the onregisteruser function, users can register with any role. This allows unauthenticated attackers to create administrator accounts. id: CVE-2025-6934 info: name: The Opal Estate Pro –...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

Netgear-WN604 downloadFile.php - Information Disclosure

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

cve-2023-22515-1

🛡️ CVE-2023-22515: Confluence 权限提升漏洞深度分析 !IMPORTANT 紧急安全警告 : 此漏洞的CVSS评分为10.0 Critical ，属于最高风险漏洞。如果您正在使用受影响版本，请立即进行补丁更新。 1. 概述 Overview CVE-2023-22515 是 Atlassian Confluence Data Center 和 Server 中发现的一个严重的破损访问控制 漏洞。攻击者可以在无需认证的情况下远程操纵服务器的配置状态，创建管理员账户，并完全控制系统。 项目| 详细信息 ---|--- 漏洞ID| CVE-2023-22515...

CVE-2026-13355

CVE-2026-13355 — Escalada de privilegios a administrador sin autenticación en Meta Box AIO Prueba de concepto en Python 3: escáner y exploit para CVE-2026-13355 en el paquete de WordPress Meta Box AIO y las extensiones relacionadas MB Frontend Submission / MB User Profile. | ---|--- Plataforma|...