wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425

WonderCMS 4.3.2 XSS to RCE Exploits Overview These scripts exploit an XSS Cross-Site Scripting vulnerability in WonderCMS 4.3.2 to achieve Remote Code Execution RCE. The XSS payload, when triggered by the admin, automatically installs a reverse shell on the target server by leveraging a crafted...

pipewire: RAOP RTSP NULL Deref

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

CVE-2026-80335

Memory Corruption when processing firmware update data in Download mode due to a missing bounds check...

EUVD-2026-116698

In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges...

CVE-2026-80335

A vulnerability exists in the bootloader download module of Unisoc (Shanghai) Technologies Co., Ltd. products. The issue is caused by a failure to reset a global offset variable during firmware update sessions, leading to a possible out-of-bounds write . This flaw could result in heap memory corr...

CVE-2026-120632

A flaw was found in the Perl CGI module. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted HTTP request. Due to an inefficient regular expression used when parsing multipart/related Content-Type headers, processing non-matching headers...

Nodejs-Tracer

nodejs-tracer Simple Node.jstracer that logs calls to core modules, can spoof certain calls to defeat anti-analysis, save files written by the application and more. Useful to analyze heavily obfuscated Node.js malware. Usage node -r .\tracer.js main.js Example trace with DISPLAYSTACK active:...

PT-2026-137020

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

PT-2026-137293

This module enables you to send messages "Notifications" to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes...

PT-2026-137001

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

PT-2026-137299

This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact...

PT-2026-137300

The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting XSS vulnerability...

PT-2026-137302

This module enables you to schedule content to be published or unpublished at a certain time in the future. The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the...

CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

PT-2026-137297

This module lets customers replace an item in their cart with one of the alternative product variations listed for it. The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts,...

PT-2026-137301

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the...

PT-2026-137304

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create conten...

CVE-2026-106554: FasterXML jackson-dataformat-cbor: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time…

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

PT-2026-137092

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot...