CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand. Usage: python3 wacrce.py "" WACPASS= python3 wacrce.py Env: WACBASE - override target base URL default below WACPASS - password, used if not passed positionally...

CVE-2025-31161

🚨 CVE-2025-31161 - Critical Authentication Bypass in CrushFTP CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP, a popular Managed File Transfer MFT solution. An unauthenticated remote attacker can impersonate any known user including the default crushadmin administrato...

cloudmapper

CloudMapper Nota : La funcionalidad de Visualización de Red comando prepare ya no se mantiene. CloudMapper te ayuda a analizar tus entornos de Amazon Web Services AWS. El propósito original era generar diagramas de red y mostrarlos en tu navegador funcionalidad ya no mantenida. Ahora contiene muc...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2024-31218-WEBHOOD-LAB

CVE-2024-31218 — Webhood / PocketBase Authentication Bypass Lab Overview This project is a controlled security research and vulnerability reproduction lab for CVE-2024-31218 , a critical authentication vulnerability affecting Webhood versions prior to 0.9.1. The vulnerability is related to the...

CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ About A Python script that automates the discovery and exploitation of vulnerabilities in misconfigured Pterodactyl panels. 🔍 Discovers exposure of sensitive configuration locale.json file. 🔑 Extracts MySQL database credentials. 👑...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...

CVE-2024-24401

Vulnerability Report CVE Disovered DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that the target system is...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — Unauthenticated Privilege Escalation 8-Fase Automasi Eksploitasi | Multiprocessing + Asyncio | Admin Creation Terverifikasi 🎯 Tentang Kerentanan Plugin WordPress WP Maps Pro versi ≤ 6.1.0 memiliki kerentanan eskalasi hak istimewa tanpa autentikasi. Penyerang...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 🚨 JAY Login & Register = 2.4.01 - Authentication Bypass via Cookie 📝 Description The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.4.01. This flaw...

CVE-2026-84259

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84260

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84261

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84259

The click5 CRM add-on for the WPForms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored XSS . The root cause is a failure to sanitize and escape content submitted via an unauthenticated endpoint before it is displayed on an admin page. This flaw allows an attacker to execute mali...

EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84261

The click5 CRM add-on for the Contact Form 7 WordPress plugin (versions through 1.0.4 ) is vulnerable to Stored XSS . The root cause is a failure to sanitize and escape content submitted via an unauthenticated endpoint before it is displayed on an admin page. This vulnerability could be exploited...

EUVD-2026-96760

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84260 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84259 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...