453663 matches found
CVE-2026-107589
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names...
CVE-2026-9789
CVE ID: CVE-2026-9789 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19670 Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. Executive Summary A critical local privilege escalation vulnerability has been...
CVE-2024-10586-Poc
Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...
CVE-2024-9290
CVE-2024-9290 Super Backup & Clone - Migrate for WordPress = 2.3.3 - Unauthenticated Arbitrary File Upload Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check o...
CVE-2024-7514
CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Authenticated Author+ Arbitrary File Read via Directory Traversal Description The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments...
CVE-2024-54369
CVE-2024-54369 Zita Site Builder = 1.0.2 - Missing Authorization to Arbitrary Plugin Installation Description The Zita Site Builder plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on one of its functions in versions up to, and including...
CVE-2024-5084
Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...
CVE-2020-36730
CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...
CVE-2023-6985
CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...
CVE-2023-2825
CVE-2023-2825 - GitLab CE/EE 16.0.0 Arbitrary File Read via Path Traversal On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated user...
CVE-2025-6440
CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...
CVE-2025-32641
🛡️ Anant Addons for Elementor Anant Addons for Elementor body background-color: 111; color: 0f0; font-family: monospace; padding: 40px; h1 color: ff0055; font-size: 24px; border-bottom: 1px solid 555; padding-bottom: 10px; .box background-color: 222; borde...
CVE-2024-7985-PoC
CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...
CVE-2025-30911
Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...
CVE-2025-2249
🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...
CVE-2025-1306
Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...
CVE-2024-9698
CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...
CVE-2024-10674
CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...
CVE-2026-107589
Jacamar CI versions prior to v0.30.0 are vulnerable to insufficient job validation for service accounts. This flaw allows authenticated CI users to generate arbitrary account names , potentially facilitating an authentication bypass by spoofing. The documents do not provide specific exploit infor...
