CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE エクスプロイトツール CVE-2023-41425 このPythonベースの攻撃的セキュリティツールは、WonderCMS 4.3.2 の Remote Code Execution RCE 脆弱性（具体的には CVE-2023-41425 ）のエクスプロイトを自動化します。悪意のあるZIPテーマモジュールを作成し、JavaScriptベースのXSSペイロード を配信して管理者セッションを乗っ取り、PHPリバースシェルを展開するプロセスを効率化します。 ⚠️ 教育目的および許可されたセキュリティテスト目的のみに使用してください。 📚 目次 ⚙️ 機能 📥...

Login Configurator <=2.1 - Cross-Site Scripting

Login Configurator WordPress plugin = 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL. id:...

Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass

The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the wplogin parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This...

Arcserve UDP <= 9.0.6034 - Authentication Bypass

Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute a...

CVE-2025-41646

CVE-2025-41646 - RevPi Webstatus = 2.4.5 認証バイパス Exploit 概要 これは、RevPi Webstatus = 2.4.5 に影響する認証バイパス脆弱性 である CVE-2025-41646 用のPython3エクスプロイトスクリプトです。 脆弱性の詳細: CVE ID : CVE-2025-41646 影響を受ける製品 : RevPi Webstatus = 2.4.5 影響 : リモート攻撃者は認証をバイパスし、有効な管理者セッションIDを取得できます。 脆弱性の種類 : 認証バイパス 攻撃ベクトル : /php/dal.php...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103292 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103277

Ghost versions from 2.5.0 before 6.34.0 are vulnerable to untrusted script execution within the oEmbed preview feature . The root cause is a failure to properly sandbox externally hosted scripts , allowing an attacker to craft malicious oEmbed content. This can lead to the execution of scripts in...

CVE-2026-85235

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-10924

CVE-2024-10924 - Really Simple Security における認証バイパス 概要 このプロジェクトは、WordPressプラグイン「Really Simple Security」における重大な認証バイパス脆弱性であるCVE-2024-10924の悪用と緩和策を実証するものです。 ステップ1: 環境構築 脆弱なWordPress環境を起動します: cd wordpress-really-simple-security-authn-bypass-vulnerable-application docker-compose up -d...

CVE-2026-66917

JoomGallery 中因对象级授权失效导致的 IDOR + 存储型 XSS JoomGallery ≤ 4.3.0 — 编辑器角色用户可劫持任意相册图片并存储 XSS 载荷，从而实现管理员会话接管 摘要 JoomGallery 中的 UserimageController::save 检查的是 checkACL'edit', ...，而非 checkACL'edit.own', ...。拥有编辑器（Editor）角色的用户可以无视图片归属，向 task=userimage.save&id=N 发起 POST（IDOR — CWE-639）。由于编辑器角色全局拥有 core.edit...

CVE-2026-2991

KiviCare = 4.1.2 - 認証バイパス（CVE-2026-2991）PoC 📜 説明 CVE-2026-2991 は、KiviCare – Clinic & Patient Management System（EHR） WordPressプラグインの認証バイパス脆弱性であり、4.1.2 までのすべてのバージョンに影響します。 このプラグインは、ソーシャルログインでユーザーを認証する公開RESTエンドポイント /wp-json/kivicare/v1/auth/patient/social-login を公開しています。patientSocialLogin...

CVE-2025-34157

Coolify削除フローにおけるStored XSS CVE-2025-34157 影響を受けるバージョン: Coolify ≤ v4.0.0-beta.420.6 修正バージョン: v4.0.0-beta.420.7 深刻度: 重大 9.4 CVSS 4.0 ベクトル: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 クロスサイトスクリプティング, CWE-20 不適切な入力検証 概要 プロジェクト削除フローにおけるStored...

Exploit for CVE-2026-93485

Laboratorio pedagógico — CVE-2026-93485 "Comment2Shell" W...

CVE-2026-94372 Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-88824

The Master Blocks WordPress plugin versions before 1.5.0 (specifically 1.4.1-1.4.1.4 ) contains an unauthenticated Stored XSS vulnerability. The root cause is a lack of authorization on one of its REST routes , which allows unauthenticated users to update plugin settings. A specific value updated...

GHSA-XHQ9-WHGQ-49J5 Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

CVE-2026-87786

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order...

CVE-2026-85130

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interac...