EUVD-2026-102808

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing

Mattermost versions 11.10.x = 11.10.0, 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user t...

EUVD-2026-102801

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...

EUVD-2026-102791

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

WSO2-2021-1261

WSO2-2021-1261: Multiple Cross-Site Scripting in WSO2 ESB Due to improper output encoding, multiple Cross Site Scripting XSS attacks have been identified in WSO2 ESB. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor...

WSO2-2021-1260

WSO2-2021-1260: Deletion of Arbitrary files via Path Traversal in Artifact Name in WSO2 ESB Due to the unsanitized user input in the Artifact Upload feature, an arbitrary file deletion attack could be carried out by leveraging path traversal in the "artifactName" parameter. Vendor Disclosure: The...

MAL-007

MAL-007: XML External Entity via Local Registry Entries in WSO2 ESB An inline XML External Entity XXE attack was identified in the WSO2 ESB “Local Entities” tool. Why no CVE? The vendor replied that this vulnerability was "Fixed in WUM" and no public disclosure was made. Requirements: This...

MAL-005

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the "Carbon Applications" add feature of WSO2 ESB. Remote code execution may be obtained by writing/overwriting specific files. Why no CVE? The vendor replied tha...

EUVD-2026-102690

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently delete...

offsec-karaf-exploits

offsec-karaf-exploits Usage: python exploit.py --help Example: python exploit.py --rhost=192.168.0.133 --rport=1337 --lhost=192.168.0.100 --lport=4444 --creds=karaf:karaf Rebuild Payload Setup Felix Framework 1. Create the lib directory mkdir -p ./revshell/lib 2. Download Felix Framework 7.0.5 3...

Splunk-RCE-poc

Splunk RCE - PoC Proof of concept exploit for CVE-2023-46214, SVD-2023-1104 Usage The Splunk instance URL, username, password, reverse shell IP, and port are all required as command-line parameters. For example: $ python3 CVE-2023-46214.py --url --username --password --ip --port Prerequisites...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ...

learning-management-system

learning-management-system Masteriyo - LMS for WordPress = 1.6.7 - Sensitive Information Exposure Plugin Info Software Type Plugin Software Slug learning-management-system view on wordpress.org Patched? Yes Remediation Update to version 1.6.8, or a newer patched version Affected Version 1.6.8...

EUVD-2026-102669

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...

grafana-ssrf

grafana-ssrf Authenticated SSRF in Grafana. Notes Azure metadata header has been added to all SSRFS Google metadata header has been added to all SSRFS SSRF will not follow redirects no matter what so ensure url is direct. If login is via SSO or other none grafana logins please grab your session...

WBCE-v1.6.3-Authenticated-RCE

WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; Once the module passes this check as a "valid Add-On", any install.php scripts are automatically executed on the server. This exploit simply uses a php reverse shell as the php payload. YouTube Demonstration:...

CVE-2026-109191

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys 6 options' parameter. This makes it possible for authenticated attackers, with...

Exploits

Exploits Collection of Exploits developed by Ron Jost For Exploit-development requests, please reach out to me: [email protected] Table of Contents: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution Authenticated: CVE-2020-35948 Wordpress Plugin Modern Events Calendar Lite 5.16.5 - RCE...

CVE-2026-103518

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...