CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

ShunyaNet-Sentinel

ShunyaNet Sentinel UPDATED: 03/02/2026 ShunyaNet Sentinel is a lightweight, cyberpunk-themed program that ingests RSS feeds e.g., breaking news, social media, sends them to an LLM for analysis, and delivers alerts and summary reports directly to the GUI and Slack at regular intervals. The project...

peer-tweet

PeerTweet Feeds descentralizados usando el DHT de BitTorrent. Idea de Arvid y The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Captura de pantalla Enlaces rápidos Descarga los últimos binarios desde la página de lanzamientos. Encuentra y comparte direcciones de PeerTweet desde la página ...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 exploit Kirby 3.9.6 XML External Entity Exploit for CVE-2023-38490 / GHSA-q386-w6fg-gmgp. Exploitation demonstration Build and run the vulnerable demo app: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2023-5612

Disclosure of the public email in Tags RSS Feed https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the...

WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed

Description WordPress does not properly restrict access to the comments associated with private and unpublished posts in some cases, which could allow unauthenticated users to read those comments through a feed...

The vulnerability of RSS and Atom feed handlers in the Git repository management system Gitea allows a hacker to disclose protected information.

The vulnerability of RSS and Atom feed handlers in the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Post Publication and Author Spoofing vulnerability

Contributor+ Post Publication and Author Spoofing vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-89006

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-89000

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

CVE-2026-89001

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin (versions before 2.8.27 ) is vulnerable to Server-Side Request Forgery (SSRF) . The issue arises because the plugin fails to perform a capability check before fetching and rendering a response from a user-supplied URL. This allows users with contrib...

CVE-2026-89003 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-89003 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

EUVD-2026-87894

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

EUVD-2026-87893

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

CVE-2026-89006 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...