Exploit for CVE-2026-84753

abraxaslabs.tech · github.com/abraxas ·&...

WordPress Form Builder CP plugin < 1.2.47 - Editor+ Stored XSS via form_structure vulnerability

Editor+ Stored XSS via formstructure vulnerability discovered by Luca Jungnickel in WordPress Plugin Form Builder CP versions 1.2.47...

CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569

CVE-2026-93569 affects the netty-codec-http2 component of the Netty library. The vulnerability occurs during the translation of HTTP/1 absolute-form requests to HTTP/2: a Host header mismatch is incorrectly propagated into the HTTP/2 :authority pseudo-header, overriding the authority specified in...

EUVD-2026-82945

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

EUVD-2026-82943

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93567

Io.netty/netty-codec-http2 is vulnerable when an HTTP/1 authority-form CONNECT request is translated into a malformed HTTP/2 CONNECT frame, resulting in a Host-controlled :authority pseudo-header. This is a network-reachable issue requiring no privileges or user interaction, with a CVSS 3.1 base ...

CVE-2026-93567 Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93567

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

WordPress Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin 2.0.5-5.1.0 - Subscriber+ Arbitrary Form Submission Deletion vulnerability

Subscriber+ Arbitrary Form Submission Deletion vulnerability discovered by JunHee CHO in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions 2.0.5-5.1.0...

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Stored XSS vulnerability

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Stored XSS vulnerability discovered by Civitasmass in WordPress Plugin Easy Form Builder versions 4.0.0-4.1.3...

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Registration Policy Bypass vulnerability

WordPress Easy Form Builder by WhiteStudio plugin 4.0.0-4.1.3- Unauthenticated Registration Policy Bypass vulnerability discovered by Artus KG in WordPress Plugin Easy Form Builder versions 4.0.0-4.1.3...

WordPress Generate PDF using Contact Form 7 plugin < 4.2.2 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Artus KG in WordPress Plugin Generate PDF using Contact Form 7 versions 4.2.2...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...