CVE-2025-53580

CVE-2025-53580 WordPress Simple Business Directory Pro Plugin 15.6.9 is vulnerable to a high priority Privilege Escalation CVE-2025-53580 Simple Business Directory Pro — Incorrect Privilege Assignment → Password Reset → Admin Takeover root@kitploit: / | |// / / / | | / | / \ / \ | | | \ /| | / |...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

CVE-2025-60378

CVE-2025-60378: Stored HTML Injection in RISE Ultimate Project Manager & CRM ⚠️ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, messaging, and automated communications -ff6600 📋 Overview A critical Stored HTML Injection vulnerability has been discovered in RISE...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...

CVE-2026-63520

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed. Stephen Fewer Rapid7 demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86753

snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter...

Blackash-CVE-2025-61882

🛡️🚨 CVE‑2025‑61882 — Critical Pre‑Auth Remote Code Execution in Oracle E‑Business Suite EBS 🚨🛡️ Short summary: Critical pre‑auth remote code execution in Oracle E‑Business Suite EBS — affects 12.2.3 → 12.2.14, CVSS 9.8 , actively exploited in the wild ransom/ extortion activity reported...

tirreno

tirreno tirreno is open security analytics. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your applications from cyber threats, account takeovers, bots, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised...

Blackash-CVE-2025-61884

CVE-2025-61884 New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login 💀 CVE-2025-61884 — Complete summary 🧾💥...

EUVD-2026-74717

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclosed a new vulnerability CVE-2025-61884, the detection script for that vuln can be found in this repo or originally here:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. As quoted from Oracle's security advisory: This Securit...

CVE-2025-61882

Oracle E-Business Suite RCE Scanner CVE-2025-61882 A fast, multi-threaded bulk scanner for detecting CVE-2025-61882 in Oracle E-Business Suite installations. This critical vulnerability allows unauthenticated remote code execution. 🎯 Features Bulk Scanning - Process hundreds or thousands of...

coeus-ci

Coeus CI Competitive Intelligence that sees all. Named after Coeus SEE-us, the 100 eyed Greek Titan of the inquisitive mind — whose name literally means "querying." CI stands for Competitive Intelligence. A business intelligence OSINT tool that builds company profiles from free public data source...

Oracle Fusion - Directory Traversal/Local File Inclusion

Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage." id: CVE-2020-14864 info: name: Oracle Fusion - Directory Traversal/Local File Inclusion author: Ivo Palazzolo @palaziv severity: high...

CVE-2026-69646

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2026-69642

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66305

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network...