Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 La CVE-2020-35489 è stata scoperta nel plugin WordPress Contact Form 7 versione 5.3.1 e versioni precedenti. Sfruttando questa vulnerabilità, gli attaccanti possono semplicemente caricare file di qualsiasi tipo, aggirando tutte le restrizioni relative ai tip...

React-site-CVE-2025-55182

React-Website – CVE-2025-55182 README: Angreifbares Next.js-Projekt React RSC Landingpage Dieses Repository enthält ein Beispiel einer mehrseitigen Corporate-Landingpage mit Next.js 15.0.0 + React 19.0.0. Die Seite simuliert eine Struktur ähnlich wie t1.ru: Startseite, Produkte, Fallstudien,...

CVE-2024-2242

CVE-2024-2242 Contact Form 7 hist...

CVE-2025-3515

CVE-2025-3515 - WordPress Datei-Upload RCE Verwendung root@kitploit: python3 exploit.py Übersicht CVE-2025-3515 ist eine Datei-Upload-Sicherheitslücke im WordPress-Plugin "Drag and Drop Multiple File Upload for Contact Form 7", die es nicht authentifizierten Angreifern ermöglicht, schädliche...

cve-2026-4257

CVE-2026-4257 Dieser Exploit nutzt CVE-2026-4257 aus, eine Server-Side Template Injection SSTI-Schwachstelle im „Contact Form“-Wordpress-Plugin von Supsystic in den Versionen 1.7.36 und früher. Diese Schwachstelle ermöglicht es einem nicht authentifizierten Angreifer, Remote Code Execution zu...

CVE-2022-24087

CVE-2022-24087-RCE e CVE-2022-24086-RCE Descrizione CVE CVE-2022-24086 e CVE-2022-24087 - vulnerabilità di convalida impropria dell'input nel modulo di contatto di Magento Open Source e Adobe Commerce - ha ricevuto un punteggio CVSS di 9,8 su 10, ed è classificata come un problema di...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 ist eine nicht authentifizierte Schwachstelle für beliebige Datei-Uploads CVSS 8.1, Hoch im Plugin „Drag and Drop File Upload for Contact Form 7“. CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Nicht authentifizierter beliebiger Datei-Upload durch Umgehung...

CVE-2026-54390

CVE-2026-54390 — Mass Exploit SSTI Smarty per JTL Shop Modulo di contatto pre-autenticazione → Oggetto email → fetch'string:' → RCE Panoramica CVE-2026-54390 è una critica CVSS 9.8 vulnerabilità di Server-Side Template Injection non autenticata in JTL Shop 5.2.0–5.7.1. Il metodo...

CVE-2024-42009

राउंडक्यूब वेबमेल 1.6.7 के लिए XSS शोषण CVE-2024-42009 विवरण यह स्क्रिप्ट राउंडक्यूब वेबमेल संस्करण 1.6.7 में एक संग्रहीत XSS कमजोरी CVE-2024-42009 का शोषण करती है। यह वेबमेल सिस्टम में एक दुर्भावनापूर्ण पेलोड इंजेक्ट करती है, जो ट्रिगर होने पर पीड़ित के इनबॉक्स से ईमेल सामग्री को बाहर निकाल लेती...

Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 La CVE-2020-35489 è stata scoperta nel plugin WordPress Contact Form 7 5.3.1 e nelle versioni precedenti. Sfruttando questa vulnerabilità, gli aggressori possono caricare file di qualsiasi tipo, aggirando tutte le restrizioni relative ai tipi di file...

wp_CVE-2020-35489_checker

wpCVE-2020-35489checker CVE-2020-35489 - Einführung Der wpCVE-2020-35489checker ist ein Python-Kommandozeilentool, das prüft, ob eine WordPress-Website für CVE-2020-35489 anfällig ist. Diese Schwachstelle beruht auf einem Sicherheitsfehler im WordPress-Plugin Contact Form 7 in Versionen vor 5.3.2...

Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. id: CVE-2017-18491 info: name: Contact Form by BestWebSoft 4.0.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple X...

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation

The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...

WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting

WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute. id: CVE-2022-2187 info: name: WordPress Contact Form 7 Captcha 0.1.2 - Cross-Site Scripting...