WordPress Event Booking Manager for WooCommerce (Pro) plugin <= 5.0.2 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Event Booking Manager for WooCommerce Pro versions = 5.0.2...

CVE-2026-90986

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

EUVD-2026-81488

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

CVE-2026-90986

Unauthenticated Cross Site Scripting (XSS) in the WordPress plugin Visitor Traffic Real Time Statistics Pro affects versions ≤ 11.21 . The vulnerability requires user interaction but no prior authentication (CVSS v3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with changed scope ind...

CVE-2024-44083

CVE-2024-44083 the original PoC repos got deleted github.com/Azvanzed/CVE-2024-44083, github.com/Azvanzed/IdaMeme so here it is. figured id recreate it for anyone who wants to understand how it works or test their setup. IDA Pro ≤ 8.4 crashes when analyzing binaries with excessive jump chains. th...

ghostlock-pfem10

GhostLock — PFEM10 Exploit de CVE-2026-43499 IonStack para OPPO Find X5 Pro PFEM10. Kernel 5.10.236-android12-9-o, futex CMPREQUEUEPI UAF → primitiva de escritura en pi-tree. Úsalo bajo tu propio riesgo. Espera panics / reinicios. No actualices el firmware. Compilación root@kitploit: ./build.sh...

CVE-2023-4861-PoC

CVE-2023-4861 PoC 本仓库包含针对 CVE-2023-4861 的 Python 概念验证（PoC），该漏洞是 WordPress 插件 File Manager Pro - Filester 中的一个经过身份验证的远程代码执行 问题。 漏洞摘要 CVE：CVE-2023-4861 产品：File Manager Pro - Filester（filester） 受影响版本： 1.8.1 修复版本：1.8.1 漏洞类型：经过身份验证的任意文件上传导致 RCE 所需权限：Filester 上的 Admin+ 权限 此 PoC 的功能 exploit.py...

QuickBox-Pro-2.1.8-Authenticated-RCE

QuickBox-Pro-2.1.8-Authenticated-RCE An authenticated low-privileged user can exploit a command injection vulnerability to get code-execution as www-data and escalate privileges to root due to weak sudo rules. QuickBox Pro v2.1.8 and prior is vulnerable...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms 修复插件 一个即插即用的 WordPress 插件，用于阻止 FunnelForms Pro ≤ 3.8.1 中存在漏洞的 Demo Import 处理器，以缓解 远程代码执行（CVE-2026-39440，CVSS 9.9） 风险。 漏洞详情 字段| 值 ---|--- CVE ID| CVE-2026-39440 CVSS 评分| 9.9（严重） 受影响版本| FunnelForms Pro ≤ 3.8.1 所需权限| 低（订阅者级别） 漏洞类型| 代码注入 → 远程代码包含 → RCE 是否已修复？| 官方厂商暂未发布补丁 发现...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro 未认证任意文件上传 → RCE CVE-2026-32475 （CVSS 9.0）的概念验证：WordPress 插件 Elementor Pro （≤ 4.2.1）中存在未认证的任意文件上传漏洞，可导致远程代码执行。 | ---|--- CVE| CVE-2026-32475 CVSS| 9.0 严重 CWE| CWE-434（危险类型文件的不受限上传） 所需认证| 无 受影响版本| Elementor Pro ≤ 4.2.1 修复版本| Elementor Pro 4.2.2（2026-08-19） 报告者| Tin Ph...

WP-CVE-2025-6934

WP-CVE-2025-6934 | Opal Estate Pro = 1.7.5 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2025-6934 vulnerability in the Opal Estate Pro = 1.7.5 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileg...

-CVE-2026-1657

CVE-2026-1657 CVE-2026-1657 漏洞利用：通过 'epuploadfilemedia' AJAX 端点进行未认证图片上传 使用方法 python3 ./CVE-2026-1657.py https://site.com/ labrat.jpeg...

CVE-2025-55891

CVE-2025-55891: Heap Corruption in TIFFCP.EXE docuPrinter Pro via Malformed TIFF File Summary A heap corruption vulnerability exists in TIFFCP.EXE, a command-line utility bundled with Neevia docuPrinter Pro, due to the use of an outdated and vulnerable version of libtiff v3.5.7. By supplying a...

sparx_hack

Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect Exploit code for executing arbitrary SQL command in Sparx PCS server without authentication. NOTE: the key is NOT correct to prevent s|rIpt kIddi3 from easy hacking ;- Full writeup:...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Unauthenticated Arbitrary File Upload Research by: Atomic Edge Severity: Critical | CVSS: 9.8 | Auth Required: None ⚠️ v2 — Technical corrections applied based on community feedback. See Changelog for details. Overview A critical unauthenticated arbitrary...

woocommerce-plugin-supply-chain-security-assessment

CVE-2026-49777 - WooCommerce产品滑块专业版恶意软件植入远程代码执行 顾问式网络安全报告 针对WooCommerce插件供应链风险的专业漏洞评估报告，涵盖业务影响、修复措施及缓解策略。 📍 报告概览 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| Web应用安全 受众| 安全团队、工程团队、招聘经理 输出风格| 执行摘要、技术分析、业务影响、修复路线图 发布状态| 经脱敏处理，用于公开作品集审核 !IMPORTANT...

lumina_server

About POC of an offline server for IDA Lumina feature. More details on https://www.synacktiv.com/publications/investigating-ida-lumina-feature.html Instalation Python package installation Download project and run python lumina/setup.py or pip install .. Server can also be used as a standalone...

CVE-2022-32118

CVE-2022-32118 - Arox-XSS Stored and Reflected Cross Site Scripting vulnerabilities exist in multiple pages of the Arox School ERP Pro application, including the login page, that allows for arbitrary execution of JavaScript commands. The application has many more parameters affected by Cross Site...

CVE-2026-1844

PixelYourSite PRO - Cross-Site Scripting Almacenado No Autenticado CVE-2026-1844 Resumen El plugin PixelYourSite PRO para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro 'pysTrafficSource' y del parámetro 'pyslandingpage' en todas las versiones hasta, e incluyendo...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...