CVE-2025-57819_FreePBX

🛡️ CVE-2025-57819 – Неаутентифицированная SQL-инъекция в FreePBX, приводящая к RCE PoC Этот репозиторий содержит два Python-скрипта Proof-of-Concept PoC, нацеленных на CVE-2025-57819 — критическую неаутентифицированную уязвимость SQL-инъекции в FreePBX. 🧠 Об уязвимости CVE-2025-57819 CVE-2025-5781...

CVE-2021-24762

Обзор Этот репозиторий документирует обнаружение CVE-2021-24762, уязвимости, выявленной на экземпляре WordPress с помощью HTTP-сканирования. Уязвимость была обнаружена на AJAX-эндпоинте WordPress: /wp-admin/admin-ajax.php Этот эндпоинт часто используется плагинами и темами WordPress для обработки...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 — Неаутентифицированное произвольное выполнение шорткодов Описание: Плагин MDTF – Meta Data and Taxonomies Filter для WordPress уязвим к произвольному выполнению шорткодов во всех версиях до 1.3.3.4 включительно. Это связано ...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Автор: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 Этот репозиторий содержит proof-of-concept эксплойт для CVE-2024-51793 — уязвимости произвольной загрузки файлов без аутентификации в уязвимом плагине WordPress, приводящей к...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Неаутентифицированная инъекция PHP-объектов Описание Плагин Lis Video Gallery для WordPress уязвим к инъекции PHP-объектов в версиях до 0.2.1 включительно через десериализацию недоверенных входных данных. Это позволяет неаутентифицированным атакующим...

Exploit for CVE-2026-17089

CVE-2026-17089 — Events Manager is in the response == RESU...

EUVD-2026-83616

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

PT-2026-95872

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

Exploit for CVE-2026-19598

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privile...

CVE-2026-81203: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-81164

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVE-2026-76997

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

EUVD-2026-63395

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...

CVE-2026-76995

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...