FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

CVE-2026-81347

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82194

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

Malicious code in coinbase-admin (npm)

Source: ossf-package-analysis 1eca83ec9ae75b7f56bdafe8c1f050ea1997c9dfb4a97d02bbf14980917d009e The OpenSSF Package Analysis project identified 'coinbase-admin' @ 999.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ Arbitrary File Deletion vulnerability

Admin+ Arbitrary File Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

CVE-2026-82194

The WPvivid — Backup, Migration & Staging WordPress plugin, in versions before 0.9.134 , is vulnerable to arbitrary file deletion due to a lack of validation on user-supplied paths within a file deletion routine. This flaw allows administrators to delete arbitrary files on the server, potentially...

CVE-2026-82194 WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

CVE-2026-82194 WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

CVE-2026-82186

The WPLP Cookie Consent WordPress plugin (specifically versions before 4.4.2 ) is vulnerable to SQL injection due to improper validation of a pagination parameter (the 'offset' parameter) within a SQL query. This flaw allows users with administrator privileges to execute arbitrary SQL commands. S...

CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ File Write Outside the Backup Directory vulnerability

Admin+ File Write Outside the Backup Directory vulnerability discovered by reconnaissance in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

CVE-2026-81347 Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.134 is vulnerable to a Path Traversal flaw. The application fails to validate user-supplied filenames when constructing a write path, which allows users with administrator privileges to write files of permitted types...

EUVD-2026-70908

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...