WordPress User Profile Builder plugin < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vulnerability

Multisite Subsite Admin+ Network Super Admin Account Takeover vulnerability discovered by Szymon Szymkowiak in WordPress Plugin Profile Builder versions 4.0.5...

WordPress Speed Optimizer plugin < 7.8.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Speed Optimizer versions 7.8.5...

CVE-2026-111737 Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-111737

The Speed Optimizer WordPress plugin in versions before 7.8.5 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape specific settings before they are outputted in the head section of front-end pages. This flaw allows high-privile...

CVE-2020-15906

CVE-2020-15906 Writeup of CVE-2020-15906. Special Thanks to Frederic MohrLastbreach for your Backend Support. Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3. is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows them to execute arbitrary code in the context of a victim's web browser. Vulnerability Type: Cross Site Scripting XSS Vendor of...

netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

CVE-2024-57523.

CVE-2024-57523 - CSRF Vulnerability in Users.php - SourceCodester Packers and Movers Management System 1.0 Description This repository contains a Proof of Concept PoC for a Cross-Site Request Forgery CSRF vulnerability in the Packers and Movers Management System 1.0 by SourceCodester. The...

CVE-2024-40617

CVE-2024-40617 Exploit PoC for CVE-2024-40617 Description See Medium publication for a detail description Fujitsu M2M GW1500 : From M2M to M2M2P0wn Usage | / | \ | | \ / \ | |/| | | ' \ | | | | | \ \ /\ / / ' \ | | | |/ /| | | | | |/ /| /| || |\ V V /| | | | || |||| || |||| / // || || usage:...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User How to use This script using Python3. Install requirements pip install -r requirements.txt Reference https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...

CVE-2020-6287-Sap-Add-User

CVE-2020-6287-Sap-Add-User sap netweaver portal add user administrator...

CVE-2025-50364_CSRF_ADD_CATEGORY-phpgurukul-CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...

Fast-Google-Dorks-Scan

Fast Google Dorks Scan The OSINT project, the main idea of which is to collect all the possible Google dorks search combinations and to find the information about the specific web-site: common admin panels, the widespread file types and path traversal. The 100% automated. Usage example: chmod +x...

CVE-2023-22515-Scan

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form PRİV8 TOOLS AND EXPLOİT CANAL: https://t.me/+zuUQbKSrHgwyZmI0...

SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515

EVENTID-197 field| Value ---|--- EventID| 197 Event Time| Nov, 09, 2023, 09:47 AM Rule| SOC235 - Atlassian Confluence Broken Access Control 0-Day CVE-2023-22515 Level| Security Analyst Hostname| Confluence Data Center Destination IP Address| 172.16.17.234 Source IP Address| 43.130.1.222 HTTP...

CVE-2024-0204

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc local file inclusion to remote code execution of Node.js code on the server, discovered by @yuriisanin Features Custom Node.js code to execute server-side using --payload-file Cleanup after exploit Requirements An admin account on the PwnDoc instance Usage $...

gladius

Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...