CVE-2026-80099

CVE-2026-80099 PoC Unauthenticated authentication bypass and RCE exploit targeting Newfold WordPress plugins that bundle wp-module-data. Overview This tool exploits a Bearer token validation flaw in the Newfold wp-module-data module. When a WordPress site using an affected Newfold plugin is not...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

Vulnerabilities in Splunk Enterprise

Splunk has identified several vulnerabilities in Splunk Enterprise. These vulnerabilities apply to various versions of Splunk Enterprise and include insufficient authorization checks in REST API endpoints, allowing unauthorized users to access privileged functions or sensitive data. Some of these...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion The plugin does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. Usage: usage: PoC.py -h -u URL -p PAYLOAD Essential Bloc...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - Missing Authorization to Infinite Money Glitch Description The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and U...

cve-2024-56348

JetBrains TeamCity Authentication Bypass + RCE CVE-2024-56348 PoC 📜 Description CVE-2024-56348 is a critical authentication bypass vulnerability in JetBrains TeamCity on-premises affecting all versions prior to 2024.12. The REST API improperly handles requests to paths containing ;.jsp, allowing ...

CVE-2025-6792

Exploit: Unauthorized Pusher Channel Subscription Eavesdropping 1 Obtain Pusher credentials from browser console console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Subscribe to a victim’s private channel Pusher Eavesdrop Test Listening on private-user-5...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability 1. Vulnerability Description Zoho ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

Splunk Enterprise 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.4.x prior to 10.4.3. Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are not affected. It is, therefore, affected by a SQL injection vulnerability as referenced in the SVD-2026-1001 advisory. A user that holds a role with the...

Splunk Enterprise 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.2.x prior to 10.2.7 or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x and 10.0.x are not affected. It is, therefore, affected by a missing authentication vulnerability as referenced in the SVD-2026-1001 advisory. An...

Splunk Enterprise 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.7, or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x is not affected. It is, therefore, affected by multiple vulnerabilities as referenced in the SVD-2026-1001 advisory, including: - A...

CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...

CVE-2025-5964-

CVE‑2025‑5964 Path Traversal PoC for M‑Files Author: Byte Reaper Telegram: @ByteReaper0 Overview This repository contains a Proof‑of‑Concept PoC in C for a suspected Path Traversal vulnerability in M‑Files version 25.6.14925.0. The PoC file exploit.c attempts to read sensitive files e.g...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...

CVE-2017-12542-Exploit

HP iLO Authentication Bypass CVE-2017-12542 This repository contains a proof-of-concept exploit for CVE-2017-12542 , an authentication bypass vulnerability affecting certain versions of HP Integrated Lights-Out iLO firmware. The vulnerability allows unauthenticated access to the iLO REST API, whi...

wp-mhn

wp-mhn Integra tu Servidor Modern Honeypot Network y tu Blog de Wordpress mediante la API REST de MHN y los shortcodes de WP. Instalación y uso 1. Descarga wp-mhn como un archivo zip, o clona el repositorio y comprímelo. 2. Edita config.sample.php con la información correspondiente a tu servidor...

CVE-2025-24000-exploit

CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...