PT-2026-98260

Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the ID argument within the updateDemoOrderPaid functi...

CVE-2026-97324: Improper Authorization

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

web-vulnerabilities-demo

Web Security — Five Common Vulnerabilities A hands-on project...

EUVD-2026-75028

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-26212 Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

CVE-2026-26212

The Rara One Click Demo Import WordPress plugin before version 1.3.5 contains an arbitrary file upload vulnerability. Authenticated attackers with Administrator privileges can pass a false value to wp_handle_upload() , disabling WordPress core's file type validation across all three file paramete...

PT-2026-89057

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp handle upload that disables WordPress core's file type...

WordPress Rara One Click Demo Import plugin <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Rinesa Krasniqi in WordPress Plugin Rara One Click Demo Import versions = 1.3.4...

CVE-2026-26212: Unrestricted Upload of File with Dangerous Type

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

xss-vulnerability-demo

xss-vulnerability-...

seal-security-nuget-demo-net7

Demo de navegador + CLI NuGet/C — Edición .NET 7 ¿Por qué un fork de .NET 7? Este es un fork reorientado del demo canónico seal-security-nuget-demo que apunta a net9.0. La historia del exploit, los controladores y la lista de paquetes sellados son idénticos — solo difiere elTargetFramework. Exist...

npm-demo

Demostración del Navegador NPM/JavaScript Para instrucciones sobre cómo ejecutar y usar esta demostración, consulte la Guía de prueba práctica...

Malicious Package

Overview stillm4ddpocs-demo-sprocket is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview stillm4ddpocs-demo-gadget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview stillm4ddpocs-demo-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-14376 Malicious code in stillm4ddpocs-demo-sprocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...

Malicious code in stillm4ddpocs-demo-sprocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

Malicious code in stillm4ddpocs-demo-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...