149 matches found
fubucker
Fubucker | CVE-2022-1386 - Fusion Builder 自动批量检查CVE-2022-1386漏洞的工具 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh 安装 JQ Linux : 命令 apt-get install jq -y Windows : 对于WSL，只需像Linux一样安装；对于GitBash，你可以执行以下命令 命令 curl -L -o C:/Program...
CVE-2022-1386
CVE-2022-1386 - Fusion Builder 3.6.2 - 未认证SSRF 描述 Fusion Builder 是一个 WordPress 插件，允许用户使用拖放界面创建和编辑页面。它存在一个未认证的 SSRF 漏洞，攻击者可以利用此漏洞读取服务器上的任意文件。 概念验证 请求： root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:98.0 Gecko/20100101...
CVE-2022-1386
説明 Fusion BuilderはWordPressのプラグインで、ユーザーがドラッグアンドドロップインターフェースを使用してページを作成・編集できるようにします。認証されていないSSRFに対して脆弱であり、攻撃者がサーバー上の任意のファイルを読み取ることを可能にします。 概念実証 リクエスト: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:98.0 Gecko/2010010...
CVE-2022-1386-FusionBuilder-SSRF
CVE-2022-1386 – Fusion Builder 示例： root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun 使用Interact.sh或Burp Collaborator接收回调。 📋 示例输出 root@kitploit: 从目标获取nonce... 向https://abc123.oast.fun发送SSRF载荷... + SSRF确认：从受害服务器收到回调。 📌 注意 此PoC不会进行数据窃取。 仅限道德使用：未经授权请勿利用系统。 📚...
WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery
WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...
CVE-2026-8713
CVE-2026-8713 — Avada Fusion Builder WordPress 漏洞利用 未经认证的路径遍历 → 任意文件删除 → 强制重装 → 远程代码执行 概述 CVE-2026-8713 是 WordPress 的 Avada Fusion Builder 插件/主题中的一个 CVSS 9.1 严重漏洞。FusionFormDBEntries 类中的 maybedeletefiles 函数使用简单的字符串替换，从攻击者控制的表单条目值构建文件系统路径——不经过 realpath 验证或目录包含检查。 未经认证的攻击者通过 处理器提交一个路径遍历负载。当...
EUVD-2026-67409
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...
WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability
Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...
CVE-2026-18431
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
EUVD-2026-66293
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
CVE-2026-18431
The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...
PT-2026-81951
Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 Description An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is...
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...
CVE-2026-12536
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Avada (Fusion) Builder plugin <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Zbigniew Piotrak in WordPress Plugin Fusion Builder versions = 3.15.5...
CVE-2026-56008
Contributor Privilege Escalation in Fusion Builder = 3.15.4 versions...