CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-20896

...

quokka

Quokka image generated by DALL-E Table of Contents Introduction Installation Usage Building Documentation FAQ Introduction Quokka is a binary exporter: from the disassembly of a program, it generates an export file that can be used without the disassembler. It currently supports IDA Pro , Ghidra...

CVE-2026-84279

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-86538

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-84279 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-84279

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.5.2 . The root cause is insufficient input sanitization and output escaping within the 'output_format' parameter. This allows unauthenticated attackers to injec...

import-users-from-csv-with-meta

import-users-from-csv-with-meta Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - Unauthenticated SQL Injection Description The Navayan CSV Export plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

WindowsFirewallRuleset

Windows Firewall Ruleset Tabla de Contenidos Windows Firewall Ruleset Tabla de Contenidos Acerca de Windows Firewall Ruleset Reglas de firewall Marco de trabajo del firewall La visión de este firewall Licencia Requisitos Detalles de los requisitos No cumplo con los requisitos Usuario primerizo...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

CVE-2026-76060_ZoneMinder_CommandInjection-PoC

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2022-0236

CVE-2022-0236 El plugin WP Import Export de WordPress es vulnerable a la divulgación de datos sensibles sin autenticación debido a una comprobación de capacidades faltante en la función de descarga wpieprocessfiledownload que se encuentra en el archivo /includes/classes/class-wpie-general.php. Es...

lapith

Lapith Lapith is a Python GUI tool that presents Nessus results in a format more useful for penetration testers. Results can be viewed by issue as opposed to by host. It is therefore easier to report all the hosts affected by an issue, rather than all of the issues affecting the host. Multiple...

SusanRTTI

SusanRTTI Otro plugin de análisis RTTI para IDA Características Todo en ida-python Diseño basado en clases, registro de errores Algoritmo de análisis RTTI que escanea primero las vtables en lugar de aplicar fuerza bruta a todas las secciones rdata/data Graficado de la jerarquía de clases usando...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Multi-threaded batch vulnerability detection FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export If this helps, please give the author a star before you leave, than...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...