CVE-2022-47447

CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ Uso exclusivo para fines educativos y entornos autorizados. PoC funcional para la vulnerabilidad CVE-2022-47447, que afecta a un plugin de WordPress vulnerable, permitiendo un ataque de tipo Cross-Site Request Forgery CSRF contra usuarios autenticados...

john

John the Ripper This is the community-enhanced, "jumbo" version of John the Ripper. It has a lot of code, documentation, and data contributed by jumbo developers and the user community. It is easy for new code to be added to jumbo, and the quality requirements are low, although lately we've start...

CVE-2021-42205

CVE-2021-42205 El controlador ELAN Miniport touchpad para Windows anterior a 24.21.51.2, utilizado en hardware de PC de múltiples fabricantes, permite a los usuarios locales provocar un bloqueo del sistema enviando una determinada solicitud IOCTL, porque esa solicitud se maneja dos veces...

CVE-2026-3629

CVE-2026-3629 - Comprobador de Escalada de Privilegios en WordPress Una herramienta de línea de comandos para detectar CVE-2026-3629 , una vulnerabilidad crítica de escalada de privilegios en el plugin de WordPress "Import and export users and customers". 📢 Únete a Nuestra Comunidad ¡Mantente al...

simplewall

simplewall Definitivamente para usuarios avanzados. Descripción: Herramienta simple para configurar la Plataforma de Filtrado de Windows WFP que puede configurar la actividad de red en su computadora. La aplicación ligera pesa menos de un megabyte y es compatible con Windows 7 SP1 y sistemas...

CVE-2025-2005

CVE-2025-2005 — Carga Arbitraria de Archivos por Usuarios de Front-End CVE-2025-2005 Usuarios de Front-End de WordPress — Carga Arbitraria de Archivos sin Autenticación 0xZ3R0 // h4ckxel 0x00 — Resumen Ejecutivo Front-End Users se ve afectado por una vulnerabilidad de carga arbitraria de archivos...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

CVE-2024-51032

CVE-2024-51032 Descripción Una vulnerabilidad de Cross-site Scripting XSS en managerecipient.php de Sourcecodester Toll Tax Management System 1.0 permite a usuarios autenticados remotos inyectar scripts web arbitrarios a través del campo de entrada 'owner'. Tipo de Vulnerabilidad Cross Site...

Users Ultra <= 3.1.0 - SQL Injection

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the datatarget parameter before it is being interpolated in an SQL statement and then executed via the ratingvote AJAX action available to both unauthenticated and authenticated users, leading to an SQL Injection...

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

FXServer < v9601 - Information Exposure

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint. id: CVE-2024-46310 info: name: FXServer v9601 - Information Exposure author: s4e-io severity: medium description: | Incorrect Access...

WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

MagnusBilling Alarm Module - Cross-Site Scripting

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling Alarm Module modules allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling-...

WP Triggers Lite - Cross-Site Scripting

WP Triggers Lite WordPress plugin v2.5.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Widget4Call WordPress - Cross-Site Scripting

Widget4Call WordPress plugin = 1.0.7 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13099 info: name:...

Ninja Forms < 3.6.26 - Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2023-37979 info: name: Ninja Forms 3.6.26 - Cross-Site Scripting author: r3Y3r53 severity:...

Shield Security Plugin < 20.0.6 - Cross-Site Scripting

The Shield Security WordPress plugin before 20.0.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'navsub' parameter in the admin dashboard, allowing authenticated users to execute arbitrary JavaScript in the context of other...

Broadstreet WordPress plugin - Reflected XSS

Broadstreet WordPress plugin 1.51.8 contains a reflected XSS caused by unsanitised and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires victim interaction. id: CVE-2025-4652 info: name: Broadstreet WordPress plugin -...

The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation

The Opal Estate Pro plugin ≤ 1.7.5 is vulnerable to privilege escalation. Due to missing role restrictions in the onregisteruser function, users can register with any role. This allows unauthenticated attackers to create administrator accounts. id: CVE-2025-6934 info: name: The Opal Estate Pro –...

DataEase 2.10.4-2.10.7 - Remote Code Execution

DataEase prior to version 2.10.8 contains a remote code execution caused by insecure backend JDBC link handling, letting authenticated users execute arbitrary code, exploit requires user authentication. id: CVE-2025-32966 info: name: DataEase 2.10.4-2.10.7 - Remote Code Execution author: ChrisJr4...