CVE-2025-11174

CVE-2025-11174: Unauthenticated Information Disclosure in Document Library Lite WordPress Plugin Keywords: CVE-2025-11174, Document Library Lite vulnerability, information disclosure, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-862, WordPress document...

CVE-2026-19632

TranslatePress Password Reset Link Disclosure to Administrator Account Takeover CVE: CVE-2026-19632 | CVSS: 9.8 Critical Unauthenticated account-takeover via TranslatePress plugin for wordpress. Time from CVE publication to working Day-One PoC: 5 hours, 9 minutes, 40 seconds Up to and including...

-CVE-2026-1657

CVE-2026-1657 CVE-2026-1657 exploit Unauthenticated Image Upload via 'epuploadfilemedia' AJAX Endpoint USE python3 ./CVE-2026-1657.py https://site.com/ labrat.jpeg...

CVE-2025-11171

CVE-2025-11171: Missing Authentication in Chartify WordPress Plugin Keywords: CVE-2025-11171, Chartify WordPress vulnerability, missing authentication, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-306, WordPress chart plugin security, authentication bypass...

CVE-2025-30772

🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce 📅 Published: March 27, 2025 🔐 CVSS Score: 8.8 High 🔥 CWE-862: Missing Authorization 🐞 Vulnerability Summary A Missing Authorization vulnerability in the WPC Smart Upsell Funnel for WooCommerce plugin allows...

CVE-2026-3395-Lab

CVE-2026-3395 — MaxSite CMS Unauthenticated RCE Lab This repository is for educational and research purposes only. All testing must be done in a local Docker lab environment. Do not deploy this setup to public or production systems. Summary CVE-2026-3395 affects MaxSite CMS and allows...

CVE-2018-7600

Drupal 7 CVE-2018-7600 / SA-CORE-2018-002 Install required libraries with: pip install requests pip install bs4 $ python3 drupa7-CVE-2018-7600.py -h ============================================================================= | DRUPAL 7 = 7.57 REMOTE CODE EXECUTION CVE-2018-7600 | | by pimps |...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link:...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Missing Authorization via handleRequest Description: The RumbleTalk Live Group Chat plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handleRequest...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 The attacker sends a specially crafted request to the wpajaxnoprivwcfmajaxcontroller AJAX action to modify the membership registration form and set the registration role to that of an administrator. Then, the plugin processes the request and modifies the membership registration...

cve-2024-3552

Description The Plugin Web Directory Free WordPress prior to version 1.7.0 contains a SQL Injection vulnerability. The AJAX execution function is not properly filtered/sanitized, allowing an attacker to manipulate the SQL query or inject additional clauses UNION, time-based, error-based Context...

CVE-2026-8732-PoC

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation English | Türkçe English Overview CVE-2026-8732 is a critical vulnerability CVSS 9.8 in the WP Maps Pro wp-google-map-gold WordPress plugin version = 6.1.0. Unauthenticated attackers can create WordPress administrator accounts by abusing...

CVE-2024-7928

FastAdmin Path Traversal Vulnerability exploit A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal...

CVE-2025-4606

CVE-2025-4606- WordPress Sala Theme = 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover 🔥 Vulnerability Summary The WordPress theme Sala versions = 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attacke...

CVE-2025-6440

CVE-2025-6440 — WordPress WooCommerce Dynamic Pricing & Discounts Plugin Overview This repository contains a Python proof-of-concept PoC script for testing an unauthenticated file upload vulnerability affecting the WordPress WooCommerce Dynamic Pricing & Discounts plugin. ⚠️ This project is...

CVE-2026-112091

A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2025-24801

CVE-2025-24801 PoC for GLPI RCE This repository contains a proof-of-concept script poc.py that exploits CVE-2025-24801, an LFI-to-RCE vulnerability in GLPI 10.0.17. It automates: Logging into GLPI Enabling .php uploads by updating document type settings Uploading a PHP reverse shell via the AJAX...