CVE-2023-0157

CVE ID : CVE-2023-0157 漏洞类型 : 目录遍历 描述 : 用于 WordPress 的 All-In-One Security AIOS 插件在版本 5.1.4 及之前版本中存在目录遍历漏洞。这使得经过身份验证且具有管理员权限的攻击者能够读取服务器上任意文件的内容。 复现步骤 : root@kitploit: Just create a test.pdf file with JavaScript content necessarily in one line and display the file in the Host system logs. An examp...

yakit

Yakit - 対話型アプリケーションセキュリティテストプラットフォーム • • • • •...

FinalRecon

Twitter - Telegram - thewhiteh4t 的博客 FinalRecon 是一个用 Python 编写的多合一自动化网络侦察 工具。它的目标是在短 时间内提供目标的概览 ，同时保持结果的准确性 。它无需依次执行多个工具 ，就能提供类似的结果，并且依赖小巧简单 。 可用平台 收录于 Python For OSINT Hakin9 April 2020 https://hakin9.org/product/python-for-osint-tooling/ NullByte...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — 在 Docker 中可复现的文档化概念验证 WordPress 插件 All-in-One WP Migration and Backup 中未经身份验证的二阶 SQL 注入 可升级为提取 ai1wmsecretkey，并借此实现远程代码执行（RCE）。 阅读语言： English · Español...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

Hack-Tool

ハッカーのためのオールインワンハッキングツール🥇 VirtualBoxを使わずにWindows10にKali Linuxをインストール YOUTUBE またはDockerを使用 アップデート利用可能 V1.1.0 🚀 新しいツールを追加 リバースエンジニアリング RATツール Webクローリング ペイロードインジェクター Multitorツールのアップデート wifijammingにツールを追加 ステガノグラフィにツールを追加 Hackingtool メニュー 🧰 匿名化ツール 情報収集ツール ワードリスト生成ツール ワイヤレス攻撃ツール SQLインジェクションツール フィッシング攻撃ツ...

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...

WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting

WordPress All-in-One WP Migration plugin 7.62 and prior contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials a...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990 fuga de información + RCE todo en uno Este PoC escribe un archivo en el objetivo; aquí escribe phpinfo. Si necesitas otras funcionalidades, modifícalo tú mismo. No lo uses con fines ilegales...

CVE-2023-0156

ID de CVE : CVE-2023-0156 Tipo de vulnerabilidad : Recorrido de directorios Descripción : El complemento All-In-One Security AIOS para WordPress es vulnerable a un recorrido de directorios en versiones hasta, e incluyendo, la 5.1.4. Esto permite a atacantes autenticados con permisos de nivel...

All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery

WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery SSRF via the 'dl' parameter found in the /public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the serve...

CVE-2022-2546

All-in-One WP Migration Versiones afectadas All-in-One WP Migration 7.63 Referenci...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: root@kitploit: ph...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 fails to sanitise and escape content stored in the ai-assistant Block within posts before rendering it in the post editor. This allows users with the contributor role or higher to inject a Stored Cross-Site Scripting (XSS) payload that executes w...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

EUVD-2026-70045

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...