FreePBX-SQLi-RCE

FreePBX CVE-2025-57819 - PoC d'injection SQL non authentifiée menant à une RCE Usage éducatif et recherche en sécurité uniquement - Voir l'avis juridique ci-dessous Preuve de concept d'exploitation pour CVE-2025-57819, une vulnérabilité critique d'injection SQL non authentifiée dans FreePBX...

CVE-2026-61511-PoC-Exploit

CVE-2026-61511 – Exploit & Vérificateur RCE Pré‑Authentification vBulletin ⚠️ UTILISATION ÉTHIQUE UNIQUEMENT – TESTS DE SÉCURITÉ AUTORISÉS Ce dépôt fournit des outils destinés uniquement aux professionnels de la sécurité autorisés, aux équipes bleues et aux testeurs d'intrusion. L'accès non...

CVE-2025-57819-poc

CVE-2025-57819 — FreePBX: неаутентифицированная SQLi → RCE Одношаговый эксплойт для неаутентифицированной SQL-инъекции в Endpoint Manager FreePBX CVE-2025-57819, объединённой в удалённое выполнение кода через таблицу cronjobs FreePBX. Только для авторизованного тестирования безопасности /...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

CVE-2025-11627

Envoyez une requête construite au gestionnaire AJAX avec le nonce extrait. root@kitploit: = // 1 trouver le script en ligne qui contient l'URL AJAX const s = ...document.scripts.findsc = sc.textContent.includes'billminozzijserrorcatched'; if !s console.error'Script with ajax URL not found. Is...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Élévation de privilèges non authentifiée via l'inscription à l'adhésion 🔴 Vue d'ensemble de la vulnérabilité CVE-2026-1492 — Élévation de privilèges non authentifiée via l'inscription à l'adhésion Description : Le plugin User Registration &...

CVE-2025-6934

🚨 Plugin WordPress OpalEstate - Vulnérabilité d'élévation de privilèges non authentifiée 🔎 Description Le plugin OpalEstate pour WordPress contient une vulnérabilité critique dans son gestionnaire d'inscription AJAX, permettant à des utilisateurs non authentifiés de s'inscrire en tant...

CVE-2026-49049

CVE-2026-49049 — сканер неаутентифицированной AJAX RCE для Helix3 JoomShaper Joomla Массовый сканер / верификатор для CVE-2026-49049 : неаутентифицированный AJAX-обработчик в плагине Helix3 Framework для Joomla v1.0 – 3.1.0 , исправлено в 3.1.1+. Только авторизованное тестирование. Используйте...

CVE-2023-6700

CVE-2023-6700 Cookie Information | Solution de consentement GDPR gratuite = 2.0.22 - Mise à jour arbitraire des options par un utilisateur authentifié Abonné+ Description : CVE-2023-6700 Le plugin Cookie Information | Solution de consentement GDPR gratuite pour WordPress est vulnérable aux mises ...

CVE-2026-75921 Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the uploadtemplatekit function. This is due to incorrect...

EUVD-2026-68968

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the uploadtemplatekit function. This is due to incorrect...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

UBUNTU-CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

EUVD-2026-68577

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-66047 ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-39492

CVE-2026-39492 — Сканер слепой SQL-инъекции WP Maps Слепая time-based SQLi без аутентификации через обход с обратными кавычками → извлечение БД Обзор CVE-2026-39492 — критическая CVSS 9.3 слепая SQL-инъекция без аутентификации в плагине WP Maps wp-google-map-plugin версий ≤ 4.9.1. AJAX-обработчик...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ En cours de test Ce PoC est activement testé et amélioré. Les fonctionnalités peuvent changer entre les versions. CVE-2026-3180 WordPress Contest Gallery — Injection SQL aveugle non authentifiée Outil d'évaluation de preuve de concept pour CVE-2026-3180 Auteur : Sudeepa Wanigarathna · Découvert...

CVE-2026-82607

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — Неаутентифицированный RCE через calluserfunc без Allowlist Сводка уязвимости Уязвимость Remote Code Execution RCE без аутентификации в плагине Avada Builder Fusion Builder версии = 3.15.2, используемом темой WordPress Avada — одной из самых популярных...