Frontend Uploader <= 0.9.2 - Cross-Site Scripting

The Frontend Uploader WordPress plugin prior to v.0.9.2 was affected by an unauthenticated Cross-Site Scripting security vulnerability. id: CVE-2014-9444 info: name: Frontend Uploader = 0.9.2 - Cross-Site Scripting author: daffainfo severity: medium description: The Frontend Uploader WordPress...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

Qwik - Unauthenticated RCE via server$ Deserialization

Qwik =1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require availability at runtime. id: CVE-2026-27971 info: name: Qwik - Unauthenticated RCE via server$ Deserialization...

MapTiler Tileserver-php v2.0 - Unauthenticated XSS

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. id: CVE-2025-44136 info: name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

React2Shell-CVE-Lab

⚛️ React2Shell: CVE-2025-55182 Verwundbares Labor ⚠️ WARNUNG: ABSICHTLICH VERWUNDBARE ANWENDUNG Dieses Repository enthält eine containerisierte Anwendung, die speziell für die Schwachstelle CVE-2025-55182 React2Shell konfiguriert ist. STELLEN Sie diesen Container NICHT in einer Produktionsumgebung...

CVE-2018-7600

Pronto, Dewa, ho aggiunto anche la sezione di utilizzo a partire da git clone, quindi il README è completo. Questa è la versione finale che ti basta copiare-incollare nel README.md del tuo repository GitHub. CVE-2018-7600 - Exploit RCE Drupalgeddon2 Questo exploit sfrutta la vulnerabilità Drupal...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Caricamento Arbitrario di File Non Autenticato Ricerca di: Atomic Edge Gravità: Critica | CVSS: 9.8 | Autenticazione richiesta: Nessuna ⚠️ v2 — Correzioni tecniche applicate in base al feedback della community. Vedi Registro delle modifiche per i dettagli...

CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ Unauthenticated RCE via calluserfunc ║║ ╚══════════════════════════════════════════════════════════════╝ 📋 Zusammenfassung...

CVE-2026-6271

CVE-2026-6271 — Scanner RCE per il Plugin WordPress Career Section Plugin: Career Section career-section CVE ID: CVE-2026-6271 Punteggio CVSS: 9.8 Critical Vettore CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Tipo di vulnerabilità: Unauthenticated Arbitrary File Upload → Remote Code Executi...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin CVE-2026-5718 — Scanner RCE per Upload File CF7 DnD Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Plugin Slug: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS Scor...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 ist eine nicht authentifizierte Schwachstelle für beliebige Datei-Uploads CVSS 8.1, Hoch im Plugin „Drag and Drop File Upload for Contact Form 7“. CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Nicht authentifizierter beliebiger Datei-Upload durch Umgehung...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 ist eine nicht authentifizierte PHP-Object-Injection-Schwachstelle CVSS 9.8, kritisch im WordPress-Plugin Everest Forms. CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder...

CVE-2026-2942

ProSolution WP Client — Scanner per Upload di File Non Autenticato e RCE Plugin: prosolution-wp-client Versione Affetta: Tipo di Vulnerabilità: Upload Arbitrario di File Non Autenticato → Esecuzione di Codice Remoto Livello di Rischio: 🔴 Critico CVSS 9.8 Requisito: pagina pubblica contenente lo...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — Scanner RCE tramite mfunc/eval in W3 Total Cache Plugin: W3 Total Cache Plugin Slug: w3-total-cache CVE ID: CVE-2026-27384 CVSS Score: 9.8 Critico CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Tipo di vulnerabilità: Esecuzione arbitraria di codice non...

CVE-2025-6254

CVE-2025-6254 python exploit.py -u http://localhost:8080 python exploit.py -f targets.txt -T 50 -t 8 python exploit.py -f targets.txt -o sonuclar.txt --role editor CVE-2025-6254 - Doctreat Core = 1.6.8 Escalation dei privilegi non autenticata UTILIZZA SOLO NEL TUO AMBIENTE DI TEST...

CVE-2025-13407

CVE-2025-13407 GravityForms 2.9.23.1 - Nicht authentifizierter beliebiger Datei-Upload TELEGRAM-GRUPPENADRESSE: https://t.me/toolsandpoc...

2026-11551

2026-11551 CVE-2026-11551: Branda Plugin - Nicht authentifizierte Privilegienausweitung durch Kontoübernahme...

CVE-2024-40348

CVE-2024-40348 POC per CVE-2024-40348 Bazaar v1.4.3 e precedenti. Tenterà di leggere /etc/passwd dal target. Panoramica Questo è uno strumento di scansione di massa e sfruttamento per CVE-2024-40348: Bazaar v1.4.3 consente a attaccanti non autenticati di eseguire un directory traversal. Questa...

poc-2025-9074

CVE-2025-9074 | Docker API CVE-2025-9074 PoC Prova di concetto Un sofisticato framework di exploitation per CVE-2025-9074, che prende di mira endpoint Docker API non autenticati, dotato di una shell interattiva integrata per l'esecuzione dei comandi. Panoramica Questo strumento automatizza lo...