WordPress Sell Media 2.4.1 - Cross-Site Scripting

WordPress Plugin Sell Media v2.4.1 contains a cross-site scripting vulnerability in /inc/class-search.php that allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. id: CVE-2019-6112 info: name: WordPress Sell Media 2.4.1 -...

External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery

WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obta...

WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload

The Frontend File Manager plugin 4.0 and N-Media Post Front-end Form plugin 1.1 for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. id:...

2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting

A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter. id: CVE-2012-4273 info: name: 2 Click Socialmedia Buttons 0.34 - Cross-Site Scripti...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

spyder-osint

Spyder🕷 Spyder is a universal open-source intelligence OSINT research tool that performs searches using large global databases. Features 1. Phone number information 2. IP address information 3. SocialsFacebook, Instagram, Telegram, Twitter information 4. Email information & Email bomber 5. Person...

EUVD-2026-92043

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-102261

CVE-2026-102261 Este proyecto contiene un verificador no destructivo para confirmar si una instancia autorizada de Camaleon CMS aplica la autorización introducida en la versión 2.9.3. Alcance El problema afecta a POST /admin/media/crop en Camaleon CMS hasta 2.9.2. Un usuario con :manage, :media,...

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - XXE autenticado Autor+ https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ uso: -l LHOST ejemplo: 127.0.0.1 -n NAME ejemplo: payload.wav -dn DTDNAME ejemplo: evil.dtd -r READ ejemplo: ../wp-config.php evil-wav-dtd-xxe.py: error: se requieren lo...

CVE-2019-11933

CVE-2019-11933 堆损坏影响 Android 版 WhatsApp（版本 2.19.291 之前）的媒体选择器 背景 GIF 文件被分割为多个段，由特定字节标记： 图像 0x2C 图像段描述 GIF 文件中的单个帧，包含高度、宽度以及压缩图像本身等信息。一个 GIF 可以有多个帧，因此有多个图像段。 扩展 0x21 扩展段包含用于修改图像的数据。 终止 0x3B 标记 GIF 文件的结束 根据源代码，renderFrame 调用 DDGifSlurp 解析 GIF，并调用 getBitmap 显示 GIF。函数分配了一个 rasterBits...

CVE-2023-39024-5-POC

CVE-2023-39024 和 CVE-2023-39025 的 POC CVE-2023-39024 和 CVE-2023-39025 Harman Media Suite 的 POC 概述 受影响的应用：Harman Media Suite 受影响的版本：4.2.0 及以下 描述：Harman Media Suite（4.2.0 及以下版本）存在服务器端请求伪造（SSRF）漏洞 CVE-2023-39025 和可能的本地文件泄露（LFD）漏洞 CVE-2023-39024。如果启用了对用户门户的匿名访问，未经身份验证的用户可能能够下载存储在 Media Suite...

system_media_AOSP10_r33_CVE-2020-0458

此存储库没有 README。...

CVE-2023-5070

CVE-2023-5070 社交媒体分享按钮和社交分享图标 = 2.8.5 - 信息泄露 描述： WordPress 的社交媒体分享按钮和社交分享图标插件在版本 2.8.5 及以下版本中，通过 sfsisaveexport 函数存在敏感信息泄露漏洞。这允许订阅者导出包含社交媒体身份验证令牌、机密以及应用密码的插件设置。 Severity: medium CVE ID: CVE-2023-5070 CVSS Score: 6.5 CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Plugin Slug:...

CVE-2024-6366

为了在WordPress插件User Profile Builder 3.11.8之前版本中利用RCE漏洞创建Metasploit模块，我们需要利用媒体文件上传功能中缺乏适当授权的问题。以下是创建此类Metasploit模块的方法： Metasploit模块 将以下代码保存为wordpressuserprofilebuilderrce.rb，并放置在Metasploit Framework安装目录的modules/exploits/unix/webapp文件夹中。 This module requires Metasploit: https://metasploit.com/downlo...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...