CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

CVE-2026-87970

The If-So Dynamic Content WordPress plugin (versions 1.8 through 1.10.1 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the render_ifso_shortcodes function. The vulnerability exists because the plugin fails to properly escape request-supplied values before reflecting them in an ...

EUVD-2026-90508

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-19253

The Cache Enabler WordPress plugin before version 1.8.17 is vulnerable to an unauthenticated arbitrary file and directory deletion vulnerability. The root cause is a failure to validate a URL before using it to build a filesystem path within the cache purge routine . Because the plugin does not c...

CVE-2026-19253 Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

Trigon

Trigon Trigon is a deterministic kernel exploit based on CVE-2023-32434. It currently supports A9 - A11 devices running iOS 13 - 15.7.6 . Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow in th...

CVE-2024-43160

Wordpress BerqWP = 1.7.6 - Unauthenticated Arbitrary File Uplaod CVE-2024-43160 The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type...

JBWPer

JBWPer | CVE-2022-4061 - JobBoardWP Automatic Mass Tool for check and exploiting vulnerability in CVE-2022-4061 - JobBoardWP install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

CVE-2025-11988

1 Extract the public cryptoajax nonce UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

CVE-2022-39952

CVE-2022-39952 POC for CVE-2022-39952 affecting Fortinet FortiNAC The default configuration of this exploit writes a cron job to create a reverse shell. Be sure to change the payload file to suite your environment. Technical Analysis A technical root cause analysis of the vulnerability and...

CVE-2025-31131

CVE-2025-31131 - YesWiki 4.5.2 Path Traversal Exploit This is an unauthenticated path traversal exploit targeting YesWiki versions prior to 4.5.2. The vulnerability exists in the squelette parameter, which allows reading arbitrary files from the server. Vulnerability Details CVE-ID: CVE-2025-3113...

CVE-2022-1292

CVE-2022-1292 Description The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands...

exploit-grafana-CVE-2021-43798

CVE-2021-43798 – Grafana Exploit About This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability CVE-2021-43798. This vulnerability affects Grafana 8.0.0-beta1 to 8.3.0. According to Shodan data, there are just over 2,000 Grafana servers exposed online, with...

CVE-2024-24576-PoC-Python

CVE-2024-24576-Poc-Python A quick POC for the vulnerability disclosed here https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ After you run the script it will ask for an arg to be passed to the BAT file. In the screenshot you can see that by adding " the...

CVE-2026-48778-PoC

CVE-2026-48778 — Notepad++ Arbitrary Code Execution PoC Severity: High CVSS 7.8 | Affected: Notepad++ ≤ 8.9.6 | Patched: v8.9.6.1 A PoC script for CVE-2026-48778, an arbitrary code execution vulnerability in Notepad++ ≤ 8.9.6. For full technical details, see the official security advisory. Usage...

git-fsmonitor

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The FSMonitor helper is executed by git on every command like git status, git diff, etc., hence git will blindly launch whatever path we specfic there. Our IDEs runs git status...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.14 . The root cause is a failure to properly verify user authorization for specific actions. Authenticated attackers with subscriber-level access and above can exploit this to...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

CVE-2025-52078

🚨 CVE-2025-52078 - Unauthenticated Arbitrary File Upload - Writebot SaaS React Template This repository contains a proof-of-concept exploit for an Unauthenticated Arbitrary File Upload vulnerability found in the Writebot – AI Content Generator SaaS React Template. 🧠 Product Page: ThemeForest –...