CVE-2026-109515

The MailOptin plugin for WordPress (versions up to and including 1.2.78.6 ) is vulnerable to unauthenticated privilege escalation . The root cause is a lack of allow-list validation on the optin_data[form_custom_field_mappings] parameter within the subscribe_to_email_list endpoint. An attacker ca...

CVE-2026-103895

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.8 ) is vulnerable to an Authentication Bypass . The root cause lies in the mo_delay_otp_process() function, which short-circuits the authentication flow before password validation o...

CVE-2026-103895 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin function. This is due to modelayotpprocess short-circuiting the authentication flow before password validation or...

EUVD-2026-102638

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin function. This is due to modelayotpprocess short-circuiting the authentication flow before password validation or...

CVE-2026-103895 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin function. This is due to modelayotpprocess short-circuiting the authentication flow before password validation or...

EUVD-2026-102636

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the...

CVE-2026-109219 Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the...

CVE-2026-109219 Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the...

CVE-2026-109219

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 2.4.4 . The vulnerability exists in the mbw_file_upload function because the image_path parameter lacks file extension validation, allowing attackers to bypass the allowlist applied to t...

arpy

Arpy Arpy is an easy-to-use ARP spoofing MiTM tool for Mac. It provides 3 targeted functions: Packet Sniffing Visited Domains Visited Domains with Gource Each function will be explained below. Tested OS to date Darwin 14.3.0 Darwin Kernel Version 14.3.0 Mac OS X Requirements Python 2.7 Gource Sca...

manticore

⚠️ Project is archived ⚠️ This project is no longer internally developed and maintained. Manticore Manticore is a symbolic execution tool for the analysis of smart contracts and binaries. Features Program Exploration : Manticore can execute a program with symbolic inputs and explore all the...

CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

MS09-050

MS09-050 — SMBv2 Remote Code Execution Exploit CVE-2009-3103 The Vulnerability Windows Vista and Server 2008 introduced SMBv2 with a new kernel driver, srv2.sys. This driver fails to validate the Process Id High field in SMB negotiate requests. By sending a specially crafted value in this field, ...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE double-free → remote code execution Verified against Rocky Linux 8.10, aarch64, Redis 8.6.2, jemalloc 5.3.0. Reference: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive TLDR; Stable exploit, works against variety of OS distro and architecture. Executive...

pyrebox

================ ARCHIVED PROJECT THIS PROJECT HAS BEEN ARCHIVED AND ITS ISSUE QUEUE IS LOCKED. THE PROJECT WILL BE KEPT PUBLIC ONLY FOR REFERENCE PURPORSES. .. image:: docs/media/pyreboxlogolightbg.png .. QEMU: http://qemu.org/ .. DECAF: https://github.com/sycurelab/DECAF .. S2E:...

CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Leading to RCE, XSS, DoS, and Credential Leakage Summary A class pollution vulnerability has been identified in Taipy v4.0.3 the latest version at the time of discovery. This vulnerability allows unauthorized attackers to overwrite the Taipy...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...

Veil-Evasion

Veil-Evasion Veil-Evasion is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. NOTE: ./setup/setup.sh should be re-run on every major version update. If you receive any major errors on running Veil-Evasion, first try re-running this script to install any...

pupy

Pupy Simple Installation pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh If you want more detailed informationRefer to the wiki Development Install git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen git submodule init git...