CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - Unauthenticated Privilege Escalation 📄 Description The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplie...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-82417 DESCRIPTION: Summary...

CVE-2024-6028-Poc

CVE-2024-6028-Poc CVE-2024-6028 Quiz Maker method getquestionscategories image image image Poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML,...

CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...

struts_rest_rce_fuzz-CVE-2017-9805-

This repository does not have a README...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

CVE-2022-1329

WP Elementor 3.6.0/1/2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version Version: 3.6.0,...

CVE-2022-29063

CVE-2022-29063: Java Deserialization via RMI Connection in Apache OfBiz The OfBiz Solr plugin is configured by default to automatically make a RMI request on localhost, port 1099. By hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a...

CVE-2025-31486-Simulation

Vite Path Traversal Lab CVE-2025-31486 A hands-on, containerized lab environment to simulate and exploit the Path Traversal vulnerability in Vite's development server, identified as CVE-2025-31486. 📖 About The Vulnerability This lab demonstrates a significant Path Traversal vulnerability found in...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2023-3460

CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application This is a vulnerable application to test the exploit for the Jetpack 13.9.1 broken access control CVE-2024-9926. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

CVE-2024-36401-WoodpeckerPlugin

CVE-2024-36401-WoodpeckerPlugin Introduction Batch detection and exploitation of CVE-2024-36401, supporting custom memory shell injection 1. Batch detection capability 2. The backend has already filtered URLs just provide the URLs 3. Can custom generate memory shell for injection default memory...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2022-45354

Download Monitor = 4.7.60 - Sensitive Information Exposure via REST API CVE-2022-45354:version found on http://wordpress.lan Details : CVE-2022-45354:version matched at http://wordpress.lan Protocol : HTTP Full URL : http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt Timestamp :...