CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ Unauthenticated RCE via calluserfunc ║║ ╚══════════════════════════════════════════════════════════════╝ 📋 概要...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework , | | | \ / | | / /| || / / | | | | | / / | / || |||/|/ // / //...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — RCE non authentifié via calluserfunc sans liste blanche Résumé de la vulnérabilité Vulnérabilité d'exécution de code à distance RCE sans authentification dans le plugin Avada Builder Fusion Builder version = 3.15.2 utilisé par le thème WordPress Avada — l'un...

CVE-2018-7600

TRAN CONG DANH - SVTT - Наставник: LUU VAN LAN - CVE-2018-7600 - Дата начала: 26/06/2024. Оглавление: 1. Обзор CVE 2. Необходимые условия 3. Анализ CVE 4. Смягчение Обзор CVE Злоумышленник мог вызвать Ajax-запрос Drupal Form API, содержащий функцию calluserfunc auto do Drupal до 7.58, 8.x до 8.3....

CVE-2025-3776

CVE-2025-3776 - Exécution de code à distance dans le plugin "Verification SMS with TargetSMS" = 1.5 Informations sur le plugin Nom du plugin : Verification SMS with TargetSMS Versions vulnérables : = 1.5 ID CVE : CVE-2025-3776 Type : Exécution de code à distance RCE Classification OWASP : A1 :...

CVE-2022-35914_poc

CVE-2022-35914poc GLPI Offsec Lab용 수정: calluserfunc, arraymap, passthru 참고자료 Proving Grounds Practice Lab: GLPI에 맞게 수정됨 https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.py Mayfly 블로그 게시글:...

CVE-2026-9009

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

CVE-2026-7465

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server...

CVE-2026-9009

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

WordPress plugin Avada (Fusion) Builder 注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...

The vulnerability of the `call_user_func` function in the LearnPress plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the calluserfunc function in the LearnPress plugin of the WordPress content management system is related to the lack of data cleansing at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through getcontent...

WordPress Marketplace 2.4.0 Arbitrary File Download

Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9013 and CVE-2014-901...

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download

Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9013 and CVE-2014-901...

WordPress Download Manager 2.7.4 Remote Command Execution

!/usr/bin/python Exploit Name: Wordpress Download Manager 2.7.0-2.7.4 Remote Command Execution Vulnerability discovered by SUCURI TEAM http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html Exploit written by Claudio Viviani 2014-12-03: Discovered...

CVE-2014-2988

EGroupware Enterprise Line EPL before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the calluserfunc PHP function, as demonstrated using th...

Horde Framework Unserialize PHP Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Horde Framework Unserialize PHP Code Execution', 'Description' = %q This module exploits a php unserialize vulnerability in Horde...