User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

profilehound

root@kitploit: / \ / / / / / / / / / // / / / // / / / // / / / / / / / / / / / // / / / / / / // / // / / / / // / // // // ///// ///,// //,/ ProfileHound ProfileHound es una herramienta post-escalada que ayuda a encontrar y alcanzar objetivos de red team localizando perfiles de usuario...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

LegacyHive

LegacyHive：Windows 用户配置文件服务任意配置单元加载权限提升漏洞 该PoC需要另一个标准用户凭据以及第三个用户名（可以是管理员账户），如果PoC成功，它将最终将目标用户配置单元挂载到当前用户的类根目录下。 该PoC已被简化，以防止公开利用；原始PoC不需要额外用户凭据，并且不限于usrclass.dat配置单元，任何配置单元都可以利用此漏洞加载，但你需要动点脑筋才能让PoC做到这一点。 该PoC在安装了2026年7月补丁的所有当前支持的桌面和服务器系统中完全有效。...

Moodle-CVE-2019-3810

Moodle CVE-2019-3810 Moodle（低于 3.6.2、3.5.4、3.4.7、3.1.16 版本）的 XSS 利用 PoC，用于权限提升（从学生到管理员）。这是我在过去对某学术机构进行渗透测试时发现的其中一个漏洞。当时仅凭这一个简单的漏洞，就足以成功窃取管理员访问权限并获得对 Moodle 的完全控制。 从 git 历史记录 可以看出，该漏洞自 Moodle 早期版本（2003 年）就已存在，直到 2019 年才被修复。 时间线： 2018 年 12 月 - 向 Moodle 报告该漏洞 2019 年 1 月 - 发布修复补丁 2021 年 4 月 - 公开 PoC ...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Luego visualiza una publicación hecha por el autor para desencadenar el XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2025-55182-PoC

CVE-2025-55182-PoC PoC para CVE-2025-55182 root@kitploit: Usage: python3 poc.py -u http://target.com --cmd "" Aviso legal Esta herramienta se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. El uso de esta herramienta para atacar objetivos sin consentimiento...

CVE-2020-25627

CVE-2020-25627 Stored XSS via moodlenetprofile parameter in user profile My PoC about this CVE User requirement: Student Or the site for registeration XSS in moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user without assigning rol...

CVE-2019-0986

Investigación de seguridad por diversión Todo enfocado en el sistema operativo Microsoft Windows CVE-2019-0986 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0986 Este es el PoC que envié a Microsoft cuando reporté la vulnerabilidad anterior. Este PoC explota "User...

CVE-2024-6366

Para crear un módulo de Metasploit para explotar la vulnerabilidad RCE en el plugin User Profile Builder de WordPress anterior a la versión 3.11.8, necesitamos aprovechar la falta de autorización adecuada en la funcionalidad de carga de archivos multimedia. Así es como puedes crear dicho módulo d...

CVE-2022-38577-Processmaker

This repository has be archived and moved to: https://github.com/sornram9254/CVE-BBP-VDP ProcessMaker - User Profile Privilege Escalation CVE-2022-38577 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Restablecimiento de contraseña arbitrario sin autenticación CVE-2025-15030 User Profile Builder — Restablecimiento de contraseña sin autenticación → Toma de control de administrador + Subida de shell root@kitploit: / / \ |/ / / / / / \ / / / \ /...

CVE-2026-5399

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Subida de medios sin autenticación Descripción El plugin User Profile Builder de WordPress anterior a 3.11.8 no cuenta con la autorización adecuada, lo que permite a usuarios no autenticados subir archivos multimedia mediante la funcionalidad de...

CVE-2026-19945

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...