CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free 未认证存储型盲 XSS 执行摘要 此仓库包含一个本地 Docker 实验环境，用于复现 CVE-2025-11262 ，这是一个影响 WordPress 插件 Link Whisper Free 的未认证存储型跨站脚本漏洞。 该实验环境对比两个插件版本： Service| Plugin version| Purpose| URL ---|---|---|--- vuln| 0.9.0| 易受攻击的目标| http://127.0.0.1:8081 patched| 0.9.1| 已修补的对比目标|...

Whisper_Bully

Whisper Bully Bluetooth BDADDR抽出・サービス妨害（DoS）・ハイジャック調査ツール © 2026 @Ymsniper — 許可を得たセキュリティ研究のみを目的としています。 概要 Whisper Bully は、Google Fast Pair（サービス UUID fe2c）をアドバタイズするデバイスを標的とする 3 段階構成の Bluetooth セキュリティ調査ツールです。CVE-2025-36911 ファームウェアパッチの範囲外 となる 2 つの未パッチの攻撃プリミティブを実証します: 未パッチの BDADDR 漏えい — プレーンな BLE...

CVE-2025-36911-Wisper_Pair_Target_Finder

这不是针对 CVE-2025-36911 的漏洞利用！！！这是一个用于发现潜在受影响设备的检测器！ 仅限在您自己的设备上使用！我对造成的损害不承担责任！ 仅在基于 Debian 的发行版上使用 python3 测试过 用法： sudo apt update && sudo apt install python3 && sudo apt install git git clone https://github.com/SteamPunk424/CVE-2025-36911-WisperPairTargetFinder- cd...

whisper-pair

快速配对漏洞扫描器 用于检测易受 WhisperPair 攻击的蓝牙配件的安全研究工具 🌐 WhisperPair 研究 • 📦 安装 • 🚀 使用 • 🔬 技术细节 ⚠️ 免责声明 本工具仅供授权的安全测试和研究使用。 未经明确授权测试设备可能违反当地法律。请仅测试您拥有或已获许可测试的设备。 🎯 关于 WhisperPair Google Fast Pair 支持受支持的蓝牙配件一键配对和账户同步。尽管 Fast Pair 已被许多流行消费品牌采用，但研究人员发现，许多旗舰产品并未正确实现 Fast Pair ，从而引入了一个缺陷，允许攻击者劫持设备并利用 Google...

WordPress Link Whisper plugin < 0.9.7 - Editor+ SQL Injection via domain Parameter vulnerability

Editor+ SQL Injection via domain Parameter vulnerability discovered by huytqtq in WordPress Plugin Link Whisper Free versions 0.9.7...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601

The Link Whisper Free WordPress plugin (versions before 0.9.7 ) is vulnerable to SQL injection due to the improper sanitization and escaping of a parameter—specifically identified as the domain parameter —before it is used in a SQL query. This flaw allows authenticated users with the Editor role ...

EUVD-2026-63816

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601: Improper Neutralization of Special Elements used in an SQL Command

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

PT-2026-79300

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-48762

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...

EUVD-2026-56975

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...

CVE-2026-48762

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...

CVE-2026-48762: Server-Side Request Forgery (SSRF)

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using fetch without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitra...

PT-2026-70915

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0 Description The OpenAI Create Transcription action handler uses the fetch function to retrieve a user-supplied audio URL without implementing existing Server-Side Request Forgery SSRF protections. SSRF is a fla...

Linux Distros Unpatched Vulnerability : CVE-2026-17512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function logmelspectrogram of the file src/whisper.cpp. The manipulation leads...

Linux Distros Unpatched Vulnerability : CVE-2026-17513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the...

CVE-2026-17513

A flaw was found in whisper.cpp, a library for machine learning. A local attacker can exploit a vulnerability in the ggmlftypetoggmltype function by manipulating the ftype argument. This manipulation leads to a reachable assertion, which can cause the application to terminate, resulting in a Deni...