CVE-2023-37979

CVE-2023-37979 Unauthentifizierte Reflected Cross-Site Scripting XSS Schwachstelle im Saturday Drive Ninja Forms Contact Form Plugin = 3.6.25 Versionen. PoC und Checker , nur zu Bildungszwecken 'python3 exploit.py https://target.com'...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Nicht authentifizierter beliebiger Datei-Upload. Beschreibung : Das Ninja Forms - File Uploads Plugin für WordPress ist anfällig für nicht authentifizierte beliebige Datei-Uploads aufgrund fehlender Dateityp-Validierung und fehlender...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begindate, enddate, or formid parameters. This can allow an attacker to steal cookie-based authentication credentials a...

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2024-7354 info: name: Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- प्रतिक्रिया: root@kitploit: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"appl...

CVE-2026-0740

ninja.py Ein experimentelles/Werkzeug-Skript, das Datei-Upload-Endpunkte des Ninja Forms -Plugins auf WordPress-Websites nutzt. Es sendet nacheinander Anfragen an die Ziele in list.txt und schreibt erfolgreiche Uploads in die Datei shell.txt. Anforderungen Python 3 requests wird normalerweise...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress. विवरण main.py वर्डप्रेस लक्ष्यों की सूची को स्कैन करता है ताकि यह निर्धारित किया जा सके कि Ninja Forms File Uploads प्लगइन CVE-2026-0740 के प्रति संवेदनशील है...

ninja-forms-brute

Ninja Forms 3.6.8 - كشف عناوين البريد الإلكتروني بدون مصادقة الوصف لا يقوم المكوّن الإضافي بحذف الملفات المؤقتة التي يتم إنشاؤها عند تصدير الإرسالات، مما قد يسمح للمهاجمين غير المصادق عليهم بتنزيلها والحصول على معلومات حساسة مثل عنوان البريد الإلكتروني للمستخدمين الذين قدموا نموذجًا، نظرًا لأن...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Nicht authentifizierter beliebiger Datei-Upload zu RCE Exploit für CVE-2026-0740 entdeckt von Selim Lanouar whattheslime. Eine vollständige technische Analyse finden Sie im vollständigen Artikel auf Lexfos Blog. Haftungsausschluss Dieses Repositor...

CVE-2026-0740-mass

CVE-2026-0740 — Motore di exploit per target di massa Autore: 0xNuts Contributore: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC per CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload che può portare a RCE. La vulnerabilità iniziale è...

CVE-2026-0740

CVE-2026-0740 🧩 Panoramica CVE-2026-0740 è una vulnerabilità di upload arbitrario di file non autenticato che colpisce: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin Questa falla consente agli aggressori di caricare file arbitrari sul server senza autenticazione, portando potenzialmente a...

The vulnerability of the NF_FU_AJAX_Controllers_Uploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin allows a attacker to execute arbitrary code.

The vulnerability of the NFFUAJAXControllersUploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin is related to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

EUVD-2026-54201

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256

The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-48549

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...