The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

OpenBullet2 <= 0.3.2 - Authentication Bypass

OpenBullet2 = 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header. id: CVE-2026-25555 info: name: OpenBullet2 = 0.3.2 -...

AffiliateImporterEb <= 1.0.6 - Reflected XSS

AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials

Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users. id: CVE-2026-44825 inf...

CVE-2026-78477 Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

CVE-2025-63820

CVE-2025-63820 Submetido por: Nicola Giuffrida Informações Fabricante: TOTOLINK Site do fabricante: TOTOLINK Modelo: A720R Versão do firmware: V4.1.5cu.630B20250509 Endereço de download do firmware: TOTOLINK Detalhes da vulnerabilidade Ao fazer login no painel de controle, o nome de usuário e a...

CVE-2023-3460

Ultimate Member - Übersicht Willkommen im Ultimate Member GitHub-Repository! Ultimate Member ist ein leistungsstarkes und flexibles Benutzerprofil- und Mitgliedschafts-Plugin für WordPress, aber manchmal weisen Plugins Sicherheitslücken auf, die zur Kompromittierung der Website führen können...

CVE-2026-23550

🧨 CVE-2026-23550 – Bypass de Administrador no Modular Connector Login de Administrador WordPress Não Autenticado via Parâmetroorigin=mo Plugin Modular Connector ≤ 2.5.1 📖 Descrição O plugin Modular Connector para WordPress versões ≤ 2.5.1 contém uma vulnerabilidade crítica de bypass de...

CVE-2024-49328-exploit

CVE-2024-49328-exploit 🌟 Описание: Этот скрипт эксплуатирует уязвимость повышения привилегий в плагине WP REST API FNS для WordPress. Уязвимость затрагивает все версии до 1.0.0 включительно, что позволяет неаутентифицированным атакующим получить привилегии администратора. ⚙️ Использование...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - Preuve de concept de contournement d'authentification AdForest WordPress Description Preuve de concept simple pour CVE-2026-1729 PoC - Vulnérabilité de contournement d'authentification dans le thème WordPress AdForest. Réalisé par f3ds cr3w est 2oo2 blog Fonctionnalités ✅ Accès...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploração CVE-2025-0316 Kit de Exploração 🚨 Exploração de Bypass de Autenticação para o Plugin WordPress WP Directorybox Manager 🔥 Script de exploração automatizado para CVE-2025-0316 — Bypass de Autenticação via ação AJAX vulnerável. ⚠️ Aviso Legal Esta ferramenta destina-se...

CVE-2020-24033

fs.com S3900 24T4S 1.7.1 का नवीनतम संस्करण और सभी पिछले संस्करण, CSRF बैकस्टेज व्यवस्थापक फॉर्म में प्रमाणीकरण या टोकन प्रमाणीकरण तंत्र नहीं है, इसलिए एक क्रॉस-साइट रिक्वेस्ट फोर्जरी उपयोगकर्ता खाता जोड़ें है जो पूर्ण पहुंच वाला उपयोगकर्ता जोड़ने के लिए है। S3900 24T4S पर सभी फॉर्म क्रॉस-साइट...

CVE-2018-12633-TPLink-Auth-Bypass

CVE-2018-12633-TPLink-Auth-Bypass دراسة حالة تقنية وتحليل استغلال لثغرة تجاوز المصادقة في البرامج الثابتة لجهاز التوجيه TP-Link TL-WR840N CVE-2018-12633. تحليل الثغرة: تجاوز المصادقة في TP-Link TL-WR840N CVE-2018-12633 ⚠️ إخلاء مسؤولية: هذا المستودع مخصص لأغراض تعليمية وبحثية فقط. التحليل المقدم...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 Acessamos a página web do WordPress onde veremos que tem MFA ativado através do plugin vulnerável: Devemos executar a PoC e fornecer os dados de acesso: De forma automática, o navegador será aberto através de u...

CVE-2024-47533

CVE-2024-47533 – Exploit de contournement d'authentification XML-RPC Cobbler 📜 Description CVE-2024-47533 est une vulnérabilité critique de contournement d'authentification dans Cobbler, un serveur d'installation Linux qui automatise les installations d'OS sur le réseau. Le défaut est causé par u...

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

PT-2026-81273

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...