CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Us...

CVE-2026-33137

CVE-2026-33137 XWiki Platform - Unauthenticated XAR Import via REST/wikis/wikiName Description The POST /wikis/wikiName REST API endpoint in XWiki Platform executes a XAR XWiki Archive import without performing any authentication or authorization checks. An unauthenticated attacker can create or...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

activemq-cve-lab

ActiveMQ Message Broker Resumen Aplicación de broker de mensajes ActiveMQ con funcionalidad de importación/exportación de mensajes. Versión: 5.11.1 Características Gestión de colas de mensajes Estadísticas y monitoreo de colas Importación/exportación de archivos de mensajes Estado del broker en...

CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 📝 Description The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2024-41453_CVE-2024-41454

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilites just for education: @ryancooley @velkymx @nolanpro @caleeli install ProcessMaker 4 Core Docker Instance frome this repository: https://github.com/ProcessMaker/pm4core-docker this is latest pm docker version PMVERSION=4.1.21, below image is...

CVE-2026-94047

samanhappy MCPHub (up to version 1.0.32) is affected by an improper privilege management flaw in the Template Import Endpoint , specifically the importTemplate function within src/services/templateService.ts. The vulnerability is remotely exploitable over the network with low complexity and low p...

CVE-2026-94047 samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of...

Cartero

Cartero Cartero is now a Go CLI with an embedded, no-configuration workspace database instead of the old MongoDB-dependent runtime. The current implementation provides: a polished terminal experience powered by Cobra and Lip Gloss a local admin web UI and safe testing pages via cartero serve...

unlicense

Unlicense A Python 3 tool to dynamically unpack executables protected with Themida/WinLicense 2.x and 3.x. Warning: This tool will execute the target executable. Make sure to use this tool in a VM if you're unsure about what the target executable does. Note: You need to use a 32-bit Python...

CVE-2022-2992

CVE-2022-2992 Ejecución remota de comandos autenticada en Gitlab mediante la importación de GitHub. Una vulnerabilidad en GitLab CE/EE que afecta a todas las versiones desde 11.10 anteriores a 15.1.6, todas las versiones desde 15.2 anteriores a 15.2.4, todas las versiones desde 15.3 anteriores a...

CVE-2022-35650

CVE-2022-35650 This is an arbitrary file read in Moodle. Prereqs You must have compromised a teacher or admin level user. Steps 1. Clone this repo: root@kitploit: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. Run this command to zip the exploit up root@kitploit: zip exploit.zip...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

EUVD-2026-83738

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...