WordPress VR Calendar <=2.3.2 - Remote Code Execution

WordPress VR Calendar plugin through 2.3.2 is susceptible to remote code execution. The plugin allows any user to execute arbitrary PHP functions on the site. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. id: CVE-2022-1392 info: name: WordPress Videos sync PDF =1.7.5 or apply the vendor-provided patch to mitigate the vulnerability. reference...

CVE-2017-14980

Exploit-CVE-2017-14980 CVE-2017-14980 向け PoC エクスプロイト — Sync Breeze Enterprise 10.0.28 の スタックベースのバッファオーバーフロー の脆弱性。 📖 エクスプロイトの完全な技術分析: 👉 https://davigsantana.github.io/posts/buffer-overflow/ 概要 このリポジトリには、Sync Breeze Enterprise の Web 認証インターフェイスにおける入力検証の欠陥の悪用を実証する、教育および研究目的で開発された 概念実証 PoC が含まれています。...

CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass

CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass 私のバージョン - CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass on Win7 x64 CVE-2018-6892...

revsync

revsync IDA Pro、Binary Ninja、Vivisect 向けのリアルタイム同期プラグイン 同期対象： コメント シンボル名 スタック変数名 構造体 コードカバレッジ（ブロックの調査に費やした時間） IDA Pro のインストール まず、IDA データディレクトリにクローンします： Windows: %APPDATA%\Hex-Rays\IDA Pro Mac/Linux: /.idapro 次に： 上記のディレクトリに idapythonrc.py というファイルを作成し、import revsync を追記します。 config.json.template を...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 Mailcow の RCE および Domain Admin 権限昇格。この脆弱性で動作するように CVE-2022-31245 の POC を変更することができます。 報告および修正: 2022-06 コードインジェクション、RCE タイプ: コードインジェクション CWE-94、RCE、ドメイン乗っ取り 影響を受けるバージョン: 2019 - 2022-06a 最近のすべての Mailcow バージョンには、システムの一般ユーザーが「Sync Job」機能を悪用して、imapsync の任意の正規表現フィールドへの perl...

CVE-2026-104464

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104422

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

EUVD-2026-91475

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104464

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to force the server to make GET requests by providing an unvalidated actor URL within the Bazar abonnements sync action. Exploitation enables attackers ...

CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain...

CVE-2026-104422

Zebra (zebrad) versions before 6.3.0 are vulnerable to a Denial of Service (DoS) attack in the block sync download path. The software reads a block's height from an unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation occurs, without penal...

EUVD-2026-91433

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version: 10.6.24 Teste...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

VulnWhisperer

취약점 스캔에서실행 가능한 데이터 생성 VulnWhisperer는 취약점 관리 도구이자 보고서 수집기입니다. VulnWhisperer는 다양한 취약점 스캐너에서 모든 보고서를 가져와 각각 고유한 파일명으로 파일을 생성하고, 해당 데이터를 나중에 Jira와 동기화하고 Logstash에 공급하는 데 사용합니다. Jira는 스캐너가 제공한 데이터로 완전한 순환 동기화를 수행하고, Logstash는 보고서 내 모든 정보를 인덱싱하고 태그를 지정합니다/resources/elk6/pipeline/의 logstash 파일 참조. 그런 다음...