1257618 matches found
PoC_CVE-2023-24055
PoCCVE-2023-24055 実行方法？ スクリプト内の$User変数を編集し、値をあなたのユーザー名に置き換えてください。 管理者としてPowerShellを開き、スクリプトを実行してください： root@kitploit: ./PoCCVE-2023-24055.ps1 スクリプト実行後にKeePassを開いてください。 結果は"C:\Users\yourusername\AppData\Local\Temp\output.xml"に保存されます。 パスワードは平文で以下のように保存されます： root@kitploit: Password ExempePassword ソース...
CVE-2023-49544
CVE-2023-49544 Customer Support System 1.0 - ローカルファイルインクルージョン 説明 : Customer Support System 1.0 はローカルファイルインクルージョンに対して脆弱です。認証されたユーザーは、ラッパーフィルタを利用したローカルファイルインクルージョン LFI 脆弱性を悪用することで、オペレーティングシステム上の PHP ファイルにアクセスし読み取ることが可能です。 脆弱な製品バージョン : Customer Support System 1.0 CVE 作者 : Geraldo Alcântara 日付.:...
CVE-2023-45966
CVE-2023-45966 umputun/remark42 的 POST 请求中的恶意 JSON 导致了 Blind SSRF。 附加信息 修复于提交：efceed6 漏洞类型其他 CWE-918：服务器端请求伪造 产品供应商 https://github.com/umputun 受影响产品代码库 受影响版本：umputun/remark42 = 1.12.1 受影响组件 /api/v1/comment 攻击类型 远程 影响代码执行 false 影响拒绝服务 false 影响特权提升 false 影响信息泄露 true 攻击向量 攻击者能够发送特制的 JSON 发现者 Dmitry...
CVE-2026-87896
The Rox Appointment Booking WordPress plugin before version 1.2.8 has a missing authorization check on its agent REST route , which returns booking staff records. This allows unauthenticated attackers to read sensitive information for every staff member, including email addresses, phone numbers, ...
EUVD-2026-80210
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87907
The Rox Appointment Booking WordPress plugin prior to version 1.2.8 fails to perform an authorization check on the REST endpoints that return booking service and category records. This allows unauthenticated attackers to read private internal notes stored on each service and category, constitutin...
EUVD-2026-80206
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...
CVE-2026-87854
Subscriptions for WooCommerce WordPress plugin versions before 2.0.3 fail to correctly validate the shared secret protecting one of its REST endpoints. This allows unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amou...
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination after a public subscription action, triggered via the ncu parameter. This flaw enables unauthenticated attackers to perform an open redirect to arbitrary external sites and to disclose a subscriber token , whi...
EUVD-2026-80208
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...
EUVD-2026-80201
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...
EUVD-2026-80202
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email...
CVE-2026-86448
The LearnPress WordPress plugin before 4.4.7 is vulnerable to unauthenticated order data disclosure via the lp_download_order function. The plugin does not perform any authentication, capability, or nonce check before serving a previously generated order export file. An unauthenticated attacker w...
EUVD-2026-80204
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...
EUVD-2026-80203
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...
CVE-2026-86447
The LearnPress WordPress plugin before 4.4.7 fails to verify user capabilities in its administrative course tool, specifically the load_content_via_ajax handler. This missing authorization check allows unauthenticated attackers to enumerate every enrolled student's display name and user identifie...
CVE-2026-86445
LearnPress WordPress plugin versions before 4.4.7 contain a missing capability check in the administrative template handler load_content_via_ajax. This allows unauthenticated attackers to retrieve the text, identifier, and type of every published quiz question on the site, as well as perform a ke...
CVE-2026-86449
The LearnPress WordPress plugin (before 4.4.7 ) contains a missing capability check in one of its REST routes. An unauthenticated attacker can supply a custom post status filter to list courses that are not published, including those in draft, pending, private, scheduled, and trashed states. The ...
EUVD-2026-80195
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing the...