210649 matches found
wordpress-CVE-2024-10924--exploit
š WordPress Really Simple Security Plugin Vulnerability CVE-2024-10924 š Overview WordPress is one of the most popular open-source Content Management Systems CMS, powering millions of websites worldwideāfrom personal blogs to full-fledged e-commerce platforms. However, in November 2024 , a critic...
CVE-2020-2733
CVE-2020-2733 - JD Edwards EnterpriseOne Tools admin password not adequately protected Pic 1: Decrypt the string Pic 2: Decrypt by giving the URL CVE-2020-2733 Application: JD Edwards EnterpriseOne Tools Versions Affected: JD Edwards EnterpriseOne Tools 9.2 Vendor URL: https://oracle.com/ Bug:...
Apache-OFBiz-Exploit
Apache-OFBiz-Exploit Exploit for Apache OFBiz CVE-2024-38856 By: Alisson Faoli Description This repository contains an exploit for the CVE-2024-38856 vulnerability found in Apache OFBiz. The flaw allows Unauthenticated RCE Remote Code Execution. Note: This exploit is provided for educational and...
CVE-2024-48322
CVE-2024-48322 You need to have an account in the RunCodes instance, any privilege. Install with poetry and run providing the base url of the instance. $ python pay.py Look at your email inbox, the password should be there...
CVE-2025-29927-Proof-of-Concept
Walkthrough Step 1 5 min Hint Which network services are exposed by the target? ā ā ā Solution kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p Step 2 5 min Hint 1 The landing page only reveals a login page, but web servers often expose additional paths. Hint 2 Try using a directory brute-forcing too...
Project-NTLM-Hash-Capture-and-Phishing-Email-Exploitation-for-CVE-2024-21413
Project Goal: The project was created to demonstrate the use of various tools for capturing NTLM hashes from users on a network and for executing phishing attacks using email. This showcases how network authentication vulnerabilities and phishing methods can be exploited to compromise systems...
CVE-2026-41452-PoC
CVE-2026-41452 ā Krayin CRM Installer Auth Bypass ā Admin Takeover CVSS 9.8 Critical Ā· CWE-287 / CWE-306 Ā· Jiva writeup Ā· VulnCheck Summary Krayin CRM's installer exposes POST /install/api/admin-config-setup plus run-migration, run-seeder without CSRF protection withoutMiddleware'web' group. The...
NotCVE-2026-0010
Summary Vulnerability: Unauthenticated IPC Local Privilege Escalation to SYSTEM via Barrier Daemon TCP Port 24801 Vendor: debauchee Barrier project Product: Barrier 2.4.0 final release, 2021-11-01 CWE: CWE-306: Missing Authentication for Critical Function Description Barrier's Windows service...
CVE-2021-40539
CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...
NextJS-CVE-2025-29927
Here's a clean and informative README.md for your GitHub repo that explains it's a vulnerable Next.js application for CVE-2025-29927 and includes a link to your setup YouTube video: š NextJS-CVE-2025-29927 - Vulnerable Demo Application This is a vulnerable Next.js application that demonstrates...
CVE-2023-51764
CVE-2023-51764 CVE-2023-51764 poc Link: https://github.com/duy-31/CVE-2023-51764 1. Add SMTP authentication 2. The script has only been tested on Kali 3. Please do not use the script for illegal purposes...
CVE-2026-93757
The Wild Apricot Login plugin for WordPress (all versions up to and including 1.0.18 ) is vulnerable to an Authentication Bypass via SSO Email-Collision Account Binding. The vulnerability occurs because the plugin falls back to a network-global get_user_by('email', ...) lookup in Module.php when ...
CVE-2026-96228 SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public finalloginajaxaction handler resolves a user and issues an authenticated session by matching the wpsslcareotp table on only the attacker-supplied phone and...
CVE-2026-93757 Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global...
EUVD-2026-112590
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public finalloginajaxaction handler resolves a user and issues an authenticated session by matching the wpsslcareotp table on only the attacker-supplied phone and...
CVE-2026-96228
The SSL Wireless SMS Notification plugin for WordPress is vulnerable to an Authentication Bypass in all versions up to and including 3.8.1 . The root cause is that the public final_login_ajax_action handler issues an authenticated session by matching the wp_sslcare_otp table using only the attack...
EUVD-2026-112591
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global...
EUVD-2026-112588
The Social Web Suite ā Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'excludeposts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-112584
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint is registered with permissioncallback = 'returntrue' and performs no Telegram...
CVE-2026-109516
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to an Authentication Bypass leading to Account Takeover in all versions up to and including 1.3.0 . The flaw exists because the /wp-json/woo-telegram/v1/main/ REST endpoint lacks Telegram webhook signature verification and use...