CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. In Enterprise cluster deployments from v26.02.1 to v26.06.2 , the coordinator accepts cluster join requests without authentication when cluster.enabled=true but cluster.shared_secret is empty. The HMAC validation in coordinator.go is ...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Escalation dei Privilegi Non Autenticata tramite la Registrazione alla Membership 🔴 Panoramica della Vulnerabilità CVE-2026-1492 — Escalation dei Privilegi Non Autenticata tramite la Registrazione alla Membership Descrizione: Il plugin User...

CVE-2025-2563

CVE-2025-2563 Il plugin User Registration & Membership per WordPress, precedente alla versione 4.1.2, non impedisce agli utenti di impostare il proprio ruolo quando il Membership Addon è abilitato, causando un problema di escalation dei privilegi e consentendo a utenti non autenticati di ottenere...

WordPress Simple Membership plugin < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability

Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple Membership versions 4.7.8...

CVE-2026-79996

The User Registration & Membership WordPress plugin versions before 5.2.6 lack a capability check when saving login settings. An authenticated user with the plugin's management capability (but not full administrator access) can modify arbitrary site options to escalate privileges to administrator...

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. id: CVE-2022-1724 info: name: WordPress Simple Membership 4.1.1 - Cross-Site Scripting author:...

User Registration & Membership WordPress plugin - Open Redirect

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. id: CVE-2026-6203 info: name: User...

CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Bypass de Autenticação Aviso Legal! As informações apresentadas neste relatório de CVE Common Vulnerabilities and Exposures são apenas para fins educacionais e informativos. Os detalhes fornecidos são baseados em recursos publicamente...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Escalatazione dei privilegi non autenticata Dichiarazione di non responsabilità! Le informazioni presentate in questo rapporto CVE Common Vulnerabilities and Exposures sono solo a scopo educativo e informativo. I dettagli forniti si basano su...

CVE-2021-1675

CVE-2021-1675 Correção sem desabilitar o Print Spooler O script verifica a existência da correção CVE-2021-1675 da Microsoft e remove membros do grupo "Pre-Windows 2000 Compatible Access" no domínio. Problemas: Com um grupo "Pre-Windows 2000 Compatible Access" vazio, as seguintes coisas param de...

CVE-2026-1492

CVE-2026-1492 - Exploit di Privilege Escalation per il Plugin WordPress User Registration Descrizione Questo repository contiene un proof-of-concept per lo sfruttamento di CVE-2026-1492 , una vulnerabilità critica che interessa il plugin WordPress User Registration & Membership. La vulnerabilità...

Bili-cracker

Ottenere Bilibili Vip tramite la vulnerabilità CVE-2026-350234...

lxd-group-privesc-report

LXD Root Escalação de Privilégio Local para root através da associação padrão ao grupo lxd e do pacote lxd-installer no Ubuntu. Demonstração executada no AWS EC2 Ubuntu Server 26.04 O bug é que a instalação padrão do Ubuntu Server 26.04 concede silenciosamente ao usuário primário a associação ao...

private-membership

Appartenenza Privata a un Insieme PSM Dichiarazione del Problema L'Appartenenza Privata a un Insieme PSM è un protocollo crittografico che consente ai client di interrogare privatamente se l'identificatore del client è membro di un insieme di identificatori detenuti da un server in modo che...

audit-xss-cve-2020-7934

CVE 2020-7934 So führen Sie den CVE aus Anforderungen 1. docker Hinweise Es ist möglich, das Angriffsskript online zu stellen mit dem JS-Code http://yourjavascript.com/ Unser JS-Skript online für den Angriff html Befehle für die Konfiguration 1. Gehen Sie zum Hauptordner dieses Projekts 2. führen...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum è uno script Python sviluppato per raccogliere utenti, computer e le loro appartenenze ai gruppi da Active Directory. In ambienti Active Directory di grandi dimensioni, strumenti come NBTEnum non erano abbastanza veloci. Eseguendo query LDAP su un controller di dominio,...