CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-37067

CVE-2026-37067 Veno File Manager Project 4.4.9 の /vfm-admin/admin-panel/view/save-cvs.php における不適切なアクセス制御により、認証されていない攻撃者が特別に細工された POST リクエストを介して、任意の日付以降の全アプリケーションログを抽出することができます。 https://github.com/user-attachments/assets/fa313c9e-aed2-449f-8e58-22297ba1de82...

CVE-2026-97338 Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

EUVD-2026-91257

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.70 . The root cause is insufficient input sanitization and output escaping within the display name field. An authenticated attacker with Subscriber-level access or ...

CVE-Wazuh

Wazuh Manager — 通过代理控制的 DataValue.index 在 inventorysync 中的 NDJSON 注入 - 草稿 已注册代理可通过 DataValue.index 夹带任意 OpenSearch bulk 操作。 GHSA-ff9g-85jq-r3g3 ⚡ 简单用法 仅在安全且获得授权的环境中使用此项目，例如： 本地虚拟机 Docker 容器 隔离的实验室环境 经授权的渗透测试环境 示例设置： git clone cd Project use python follow below Create a virtual environment python ...

BackupCreds

BackupCreds | | | | | | | Dump all the Creds! | | | | | | | | | | | | Lefteris lefty Panos | || 滥用 SeTrustedCredmanAccessPrivilege 转储用户凭据 该程序能够转储用户在 Windows 凭据管理器中存储的凭据。 在存在提权 shell 且当前有多个用户登录的情况下，这是一种有用的技术。 步骤 1. 找到我们要转储其凭据的用户对应的 WinLogon 进程 2. 使用 PROCESSQUERYLIMITEDINFORMATION 访问权限打开 WinLogon 进...

CVE-2026-0092

CVE-2026-0092 在包管理器中，由于缺少权限检查，可能存在设备锁控制器绕过的问题。这可能导致本地权限提升，且无需额外的执行权限。利用该漏洞无需用户交互。 NVD - CVE-2026-0092 Android 安全公告 - Android 17...

CVE-2026-13718

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-91022 Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any...

WordPress Motors plugin < 1.4.124 - Listing Manager+ Stored XSS vulnerability

Listing Manager+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Motors versions 1.4.124...

CVE-2026-13718 Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

CVE-2026-13718

The Tabs Responsive WordPress plugin, affecting versions through 2.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize the content of WooCommerce product tabs before it is stored and subsequently rendered. This flaw allows an attacker with shop manager...

CVE-2026-13718 Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

EUVD-2026-91190

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page...

wp-file-manager

wp-file-manager WP File Manager 6.9 - 任意のファイルアップロードによるRCE usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File of URLS to check + Testing https://localhos...

js-jobs

js-jobs JS Job Manager プラグインを有効化するには ここには制限があり、プラグインが /.php ファイルを持っている必要があります。そうでないと有効化されません: POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With:...

symboliclink-testing-tools

symboliclink-testing-tools c Google Inc. 2015 開発者: James Forshaw これは、Windowsのさまざまなシンボリックリンクの種類をテストするための小さなツール群です。以下のツールで構成されています： BaitAndSwitch : シンボリックリンクを作成し、OPLOCKを使用してTOCTOU競合に勝利します CreateDosDeviceSymlink: csrssを使用してオブジェクトマネージャのシンボリックリンクを作成します CreateMountPoint: 任意のファイルマウントポイントを作成します...

TaskManager-Button-Disabler

TaskManager-Button-Disabler タスクマネージャーのボタンを無効化／名称変更するシンプルな方法。 インストール git clone https://github.com/Mrakovic-ORG/TaskManager-Button-Disabler cd TaskManager-Button-Disabler\TaskManager Button Disabler dotnet build 機能 killプロセスボタンの名称変更 killプロセスボタンの無効化 TaskMgr、ProcessHackerなどで動作します 動作例...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...