CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...

EUVD-2026-65276

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65274

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75930

FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...

CVE-2024-40445_CVE-2024-40446

Riferimento Vulnerabilità MimeTeX CVE-2024-40445 e CVE-2024-40446 Questo repository funge da riferimento pubblico per i problemi di sicurezza CVE-2024-40445 e CVE-2024-40446 che riguardano MimeTeX, un renderer LaTeX leggero e open-source scritto in C. ⚠️ MimeTeX sembra non essere più mantenuto...

CVE-2026-75982

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

sudo-snooper

sudo-snooper sudo-snooper acts like the original sudo binary to fool users into entering their passwords. It will show a fake prompt just like the original to the user to enter their sudo password. This can be useful in penetration tests or security evaluations for testing user knowledge...

CVE-2018-18441-exploit

CVE-2018-18441-exploit root@kitploit: Le telecamere Wi-Fi della serie D-Link DCS espongono informazioni sensibili riguardanti la configurazione del dispositivo. I dispositivi interessati includono molti della serie DCS, come: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L,...

CVE-2022-37706-LPE-exploit

CVE-2022-37706 皆さん、今回は私が発見した最近の0-dayについてお話しします。Linuxの主要なウィンドウマネージャの一つであるEnlightenment https://www.enlightenment.org/ に関するものです。 この0-dayは、任意のユーザーを非常に簡単かつ即座にroot権限に昇格させます。 このエクスプロイトはUbuntu 22.04でテストされていますが、どのディストリビューションでも問題なく動作するはずです。...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Una vulnerabilità di estrazione dati non autenticata nelle stampanti Kyocera, che consente il recupero in chiaro della rubrica e delle password di dominio. Panoramica della vulnerabilità Nel 2021, durante un pen test, stavo giocherellando con l'applicazione client pesante di...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: Autenticazione mancante su /api/v1/full-spec divulga l'intero schema OpenAPI Prodotto: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/api/Spec.py CWE: CWE-306 — Autenticazione mancante per funzione critica CVSS 3.1:...

CVE-2025-54962

🔥 CVE-2025-54962 — Upload di file non sicuro nel webserver OpenPLC Runtime OpenPLC Runtime ≤ 2024-12-31 — XSS persistente, CSRF 📌 Riepilogo Ho scoperto una vulnerabilità nel webserver OpenPLC Runtime versione rilasciata: 2024-12-31 che consente agli utenti autenticati di caricare file arbitrari a...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...

CVE-2025-26326

CVE-2025-26326 Vulnerabilità di sicurezza critica negli add-on di connessione remota NVDA Remote e Tele NVDA Remote. Questa vulnerabilità è stata registrata come CVE-2025-26326 in CNA MITRE. Questa CVE/vulnerabilità è stata pubblicata nei seguenti database globali: NVD, National Institute of...

EvilnoVNC

EvilnoVNC EvilnoVNC è una piattaforma di phishing pronta all'uso. A differenza di altre tecniche di phishing, EvilnoVNC permette di bypassare il 2FA utilizzando un browser reale tramite una connessione noVNC. Inoltre, questo strumento ci consente di vedere in tempo reale tutte le azioni della...

GEVAUDAN

GEVAUDAN Accesso ai dati e Nuke dell'autenticazione vulnerabile in ambiente Gluster. Per Iniziare Gevaudan è un exploit per Red Hat GlusterFS relativo alle CVE 2018-1088 e 2018-1112. Disponibile sia in formato standalone sia come modulo Metasploit. Presentazioni | Data| Conferenza| Link al video|...

CVE-2026-75019 Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

EUVD-2026-65273

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-75019

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE WordPress plugin is vulnerable to Stored XSS via the cozyHoverEffect Block Attribute in all versions up to and including 2.2.16 . The root cause is insufficient input sanitization and output escaping : an authenticated attacker with contri...