monitorr-exploit-toolkit

Kit d'exploitation Monitorr RCE via téléversement de fichier non sécurisé reverse shell PHP, webshell, etc. Création de compte administrateur via contournement d'autorisation Fuite d'informations techniques : version de Monitorr, version de PHP, version du système et noyau, configuration PHP, etc...

CVE-2026-13355

CVE-2026-13355 — Élévation de privilèges administrateur non authentifiée dans Meta Box AIO Preuve de concept Python 3 — scanner et exploit pour CVE-2026-13355 dans le bundle WordPress Meta Box AIO et les extensions associées MB Frontend Submission / MB User Profile. | ---|--- Plateforme| Plugin...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ تصعيد امتيازات غير مُصادق عليه عبر إنشاء حساب مسؤول ♡ === shadow ♡ & friska === 📋 معلومات الثغرة الحقل| التفاصيل ---|--- معرف CVE| CVE-2026-8732 درجة CVSS| 9.8 حرجة متجه CVSS| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H النوع| غياب المصادقة لوظيفة حرجة الملح...

WordPress CoCart plugin 4.9.0-4.9.6 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CoCart – Headless ecommerce versions 4.9.0-4.9.6...

CVE-2026-93549

The CoCart WordPress plugin, in versions 4.9.0 through 4.9.6 , contains a vulnerability where it fails to scope its REST API authentication filter to its specific endpoints. This oversight disables the WordPress core REST nonce protection across all routes. An attacker can exploit this flaw to pe...

CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability

CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

PT-2026-99248

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows an unauthenticated attacker to perform actio...

EUVD-2026-87217

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new...

WordPress CheckView plugin < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass vulnerability

Administrator Account Creation via REST API Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin CheckView Automated Testing versions 2.3.2...

CVE-2026-12793: Improper Privilege Management

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-18116: Improper Neutralization of Input During Web Page Generation

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-75843

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...