Lucene search
+L

73 matches found

Kitploit
Kitploit
added 2026/09/03 5:28 p.m.3 views

wp2shell-Hestia-Scanner

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά HestiaCP 서버용 읽기 전용 WordPress 보안 스캐너. 호스팅된 모든 사이트에서 wp2shell 침해 지표를 탐지합니다 — 클라이언트별 이메일 보고서, 코어 파일 diff, SHA256 웹셸 탐지, 위험 점수, 선택적 AI 평가 포함. ⚠️ 안전한 버전: WordPress 6.8.6 / 6.9.5 / 7.0.2 이상. 이 스크립트는 아무것도 수정하지 않습니다 — 전체 과정이 읽기 전용입니다. 🇬🇧 English...

6.6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/31 1:32 a.m.2 views

wp2shell-scan

wp2shell-scan Detect and clean upwp2shell CVE‑2026‑63030 compromise across one or many WordPress sites. wp2shell is the pre‑authentication remote‑code‑execution vulnerability fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. A public PoC appeared within a day and mass‑exploitation followed...

9.8CVSS7.4AI score0.97271EPSS
SaveExploits76References2
The Hacker News
The Hacker News
added 2026/04/10 6:28 a.m.11 views

Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers

Unknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoor. The incident impacts Smart Slider 3 Pro version 3.5.1.35 for WordPress, per WordPress security company Patchstack. Smart Slider 3 is a...

6.8AI score
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/03/26 3:01 p.m.22 views

CVE-2026-33133

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...

8.6CVSS6.1AI score0.00401EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/03/20 10:31 a.m.3 views

CVE-2026-33133

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...

8.6CVSS6.1AI score0.00401EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 2026/03/20 10:31 a.m.11 views

CVE-2026-33133 WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...

8.6CVSS6.1AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/03/20 10:31 a.m.33 views

CVE-2026-33133 WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...

8.6CVSS0.00401EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2026/03/05 7:51 a.m.10 views

CVE-2026-2994

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

6.8CVSS5.9AI score0.00208EPSS
SaveExploits1References1
OSV
OSV
added 2026/03/04 3:31 a.m.6 views

GHSA-W9QG-CHFH-G3Q9 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave thanks M3dium for reporting...

4.8CVSS5.9AI score0.00199EPSS
SaveExploits1References4
EUVD
EUVD
added 2026/03/04 3:31 a.m.13 views

EUVD-2026-9360

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting...

4.8CVSS5.9AI score0.00199EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/03/04 3:31 a.m.15 views

EUVD-2026-9357

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

6.8CVSS5.9AI score0.00208EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/03/04 3:31 a.m.10 views

Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team thanks z3rco for...

6.8CVSS5.9AI score0.00208EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 2026/03/04 3:31 a.m.25 views

GHSA-6MXW-2VHF-42G5 Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team thanks z3rco for...

2.3CVSS5.9AI score0.00208EPSS
SaveExploits1References4
NVD
NVD
added 2026/03/04 3:16 a.m.12 views

CVE-2026-2994

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

6.8CVSS0.00208EPSS
SaveExploits1References2
CVE
CVE
added 2026/03/04 2:18 a.m.45 views

CVE-2026-2994

Concrete CMS versions prior to 9.4.8 are vulnerable to CSRF via the Anti-Spam Allowlist Group Configuration (group_id parameter). The root cause is that changes are saved before CSRF token validation, enabling a Rogue Administrator to bypass CSRF protections. Affected software: Concrete CMS

6.8CVSS5.9AI score0.00208EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/03/04 2:18 a.m.7 views

CVE-2026-2994 Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

2.3CVSS5.9AI score
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/03/04 2:18 a.m.7 views

CVE-2026-2994

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

2.3CVSS5.9AI score0.00208EPSS
SaveExploits1References3
Vulnrichment
Vulnrichment
added 2026/03/04 2:18 a.m.6 views

CVE-2026-2994 Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

2.3CVSS5.9AI score0.00208EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/03/04 2:18 a.m.39 views

CVE-2026-2994 Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group

Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via groupid parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerabilit...

2.3CVSS0.00208EPSS
SaveExploits1References2
CVE
CVE
added 2026/03/04 2:00 a.m.35 views

CVE-2026-3242

Concrete CMS

4.8CVSS5.9AI score0.00199EPSS
SaveExploits1References2Affected Software1
Rows per page
Query Builder