4636 matches found
CVE-2026-13736
CVE-2026-13736: NewPath WildApricotPress Add-on β Member Directory = 1.0.0 β Unauthenticated Member PII Disclosure via REST API π Advisory Overview CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information PII disclosure vulnerability affecting the NewPath WildApricotPress...
CVE-2023-3460
CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...
CVE-2023-3460
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk! thanks for Β©gbrsh, I improved the tool a bit...
S2-053-CVE-2017-12611
S2-053-CVE-2017-12611 A simple script for exploit RCE for Struts 2 S2-053CVE-2017-12611 Usage exploit.py Example $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...
CVE-2026-112293
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...
EUVD-2026-104280
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...
CVE-2022-24227-updated
CVE-2022-24227 Updated - BoltWire v8.00 - Stored Cross-site Scripting XSS Description CVE-2022-24227 Updated : In version 8.00 of BoltWire CMS , the First Name and Last Name fields on the member registration completion page are also vulnerable to stored cross-site scripting XSS attacks, just like...
CVE-2024-1071-PoC-Script
CVE-2024-1071 Exploit Script π π Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end userβs responsibility to obey all applicable local, state, and federal...
WordPress-Exploit-CVE-2024-1071
WordPress CVE 2024-1071 SQL Exploit This exploit, which runs on WordPress versions 2.1.3 to 2.8.2, allows unauthenticated attackers to add additional SQL queries to existing queries that can be used to pull sensitive information from the database. Dork: body="/wp-content/plugins/ultimate-member" ...
CVE-2024-1071
CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
Member Hero <=1.0.9 - Remote Code Execution
WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...
WordPress WPCOM Member <= 1.7.6 - SQL Injection
WPCOM Member plugin for WordPress up to 1.7.6 contains a time-based SQL Injection caused by insufficient escaping and lack of preparation on the 'userphone' parameter, letting unauthenticated attackers extract sensitive information, exploit requires sending crafted 'userphone' parameter. id:...
CVE-2023-3460
CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This script perform an exploit for this vulnerability and scan different...
CVE-2026-96451
CVE-2026-96451 WordPress Ultimate Member plugin Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation. This issue affects Ultimate Member: from n/a through 2.13.1. Field| Value ---|--- π CVE| CVE-2026-96451 π·οΈ...
CVE-2023-3460
Ultimate Member - Overview Welcome to the Ultimate Member GitHub repository! Ultimate Member is a powerful and flexible user profile and membership plugin for WordPress but Sometimes Plugins has some vulnerability and lead to website compromisation Important Notice: Please note that the version o...
CVE-2024-1071-SQL-Injection
Proof of concept CVE-2024-1071: WordPress Vulnerability Exploited Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end userβs responsibility to obey all...
CVE-2023-3460
CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...
CVE-2023-3460
π¨ CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...
CVE-2026-111913
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groupsrolesexport check in modules/groups-roles/listsshow.php omits pdfl, which later runs the pdf export, letti...