WPSniper

WPSniper CVE-2026-87902 WordPress Core 检测器。 getpagetemplate 可被操纵，使页面模板解析包含活动主题之外的可读本地 .php 文件。WPSniper 对站点进行指纹识别，选取一个已发布的 pageid，探测 include 类，仅当探测响应体中存在唯一的强 PEAR 特征时，才输出 VULN 。 仅检测。无 webshell。无 pearcmd config-create。无操作系统命令执行。 python3 WPSniper.py -u https://lab.wordpress.local --shell 流水线：...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core：页面模板解析中的未认证路径遍历 WordPress Core 中通过双重编码的 pagename 值实现的未认证本地 PHP 文件包含——并且在特定部署条件下，以 Web 服务器账户权限执行 PHP 代码。 | ---|--- CVE| CVE-2026-87902 厂商公告| GHSA-7hp8-65ch-5whp 技术分析| CVE-2026-87902: Critical WordPress file inclusion and conditional RCE 受影响版本| WordPress Core 4.7.0 –...

CVE_2026_87902

CVE-2026-87902 — WordPress Scanner & PoC A Python scanner for...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core Path Traversal / LFI Unauthen...

Exploit for CVE-2026-87902

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-34151

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

EUVD-2026-77676

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

CVE-2026-34151: Path Traversal: '../filedir'

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

PT-2026-86520

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-13609

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...

CVE-2026-13609: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...

CVE-2026-13400

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-13400

The Simply Schedule Appointments WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 1.6.12.2 . The root cause is a sanitization-ordering defect where notification content is decoded back into live HTML after passing through the ...

PT-2026-64839

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-13400: Improper Neutralization of Input During Web Page Generation

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the GetAssetAbsPath process. An attacker can access sensitive files by sending specially crafted HTTP requests with double URL-encoded path segments to the /assets/path endpoint in publish...

CVE-2026-54017: Improper Limitation of a Pathname to a Restricted Directory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in backend/openwebui/routers/terminals.py does not fully confine the user-controlled path segment before forwarding it to an admin-configured termin...

CVE-2026-9658

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost:...

Directory Traversal

SiYuan is vulnerable to Directory Traversal. The vulnerability is due to improper validation of file paths in the /export endpoint, which allows an attacker to use double-encoded traversal sequences to read arbitrary files and obtain sensitive information...