877 matches found
CVE-2024-43917
CVE-2024-43917 一个概念验证，用于利用 CVE-2024-43917。基于 PatchStack 的文章。 使用方法 root@kitploit: usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wish list optional arguments:...
WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection
In the latest version 2.8.2 as of writing the article and below, the plugin is vulnerable to a SQL injection vulnerability that allows any users to execute arbitrary SQL queries in the database of the WordPress site. No privileges are required to exploit the issue. The vulnerability is unpatched ...
TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload
TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...
truegaze
truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...
CVE-2022-31101
CVE-2022-31101 PrestaShop bockwishlist 模块 2.1.0 SQL注入漏洞利用 CVE-2022-31101 使用方法 python3 cve-2022-31101.py 在提示时提供愿望清单的url。例如：http://example.com/module/blockwishlist/view?idwishlist=1 在提示时提供你账户的cookies。 现在它将开始攻击该网站。 实际运行效果 注意 此利用程序假设数据库中表名的前缀为 ps。这是 PrestaShop 提供的默认前缀。...
CVE-2025-47577
CVE-2025-47577 - WordPress TI WooCommerce Wishlist 中已上传图片的路径 💾 将有效的已上传图片 URL 保存到 result.txt 💾 将有效的愿望清单 URL 保存到 resultwishlist.txt 🧠 研究人员 致谢：Patchstack Database 🚀 使用方法 1. 准备 list.txt 文件，其中包含目标域名列表（每行一个，不带 http）。 2. 将要上传的文件（例如 hinata.jpg）放在同一文件夹中。 3. 运行脚本： root@kitploit: python3 CVE-2025-47577.py 示...
WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...
CVE-2024-43917
CVE-2024-43917 此脚本演示了在 WordPress 的 TI WooCommerce Wishlist 插件（版本至 2.8.2）中发现的一个 SQL 注入漏洞（CVE-2024-43917）。该漏洞允许未经身份验证的用户在网站数据库上执行任意 SQL 命令，可能暴露敏感信息，如用户名和密码。 用法 安装所需的 Python 依赖： bash pip install requests 将脚本中的 targeturl 替换为易受攻击网站的 URL。 运行脚本： bash root@kitploit: python exploit.py 免责声明...
CVE-2025-47577
CVE-2025-47577 针对 CVE-2025-47577 开发的概念验证代码。基于 PatchStack 的 文章。 使用方法 root@kitploit: usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list PRODUCTID ID of the...
CVE-2026-66631
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-66631
CVE-2026-66631 affects the MC Woocommerce Wishlist WordPress plugin (plugin slug: smart-wishlist-for-more-convert ) in versions
CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
EUVD-2026-81511
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.21...
CVE-2026-66631: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 Information Disclosure
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read...
CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 Information Disclosure
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read...
VulnCheck KEV: CVE-2022-0412
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...