CVE-2023-7028

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you...

CVE-2019-16097

CVE-2019-16097 This program is only for security research, do not use it illegally! Vulnerability Impact Attackers can create an administrator account, upload malicious images, and infect clients using the repository. Affected Component Harbor Affected Versions 1.7.0-1.8.2 Remediation Upgrade to...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2026-14378

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

EUVD-2026-91165

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revertswitch handler trusting the attacker-controlled originaluserid cookie as the privileged identity:...

CVE-2026-14378

The DevKit Pro plugin for WordPress (versions ≤ 2.3.0 ) is vulnerable to an Authentication Bypass leading to full Administrator Account Takeover . The root cause is a flawed user-switch "revert" flow where the revert_switch handler trusts the attacker-controlled original_user_id cookie to identif...

monitorr-exploit-toolkit

Monitorr エクスプロイトツールキット RCE は 安全でないファイルアップロード によるもの（PHP リバースシェル、ウェブシェルなど） 管理者アカウント作成 は 認証バイパス によるもの 技術情報の漏えい : Monitorr バージョン、PHP バージョン、システムバージョンとカーネル、PHP 設定など エクスプロイト対象: CVE-2020-28872 および CVE-2020-28871。 PacketStorm 使い方 $ ruby exploit.rb -h Monitorr-Exploit Usage: exploit.rb upload --debug...

WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation

User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...

The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation

The Opal Estate Pro plugin ≤ 1.7.5 is vulnerable to privilege escalation. Due to missing role restrictions in the onregisteruser function, users can register with any role. This allows unauthenticated attackers to create administrator accounts. id: CVE-2025-6934 info: name: The Opal Estate Pro –...

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

Netgear-WN604 downloadFile.php - Information Disclosure

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

PT-2026-104073

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert switch handler trusting the attacker-controlled original user id cookie as the privileged identity: verify non...

Exploit-CVE-2023-22515

利用 CVE-2023-22515 一个用于 CVE-2023-22515 的简单 Bash 脚本漏洞利用工具。 信息 Confluence Data Center 和 Server 实例存在一个访问控制失效漏洞（CVE-2023-22515），允许攻击者创建未经授权的 Confluence 管理员账户并访问 Confluence 实例。 受影响版本 8.0.0 8.0.1 8.0.2 8.0.3 8.0.4 8.1.0 8.1.1 8.1.3 8.1.4 8.2.0 8.2.1 8.2.2 8.2.3 8.3.0 8.3.1 8.3.2 8.4.0 8.4.1 8.4.2 8.5.0...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core Plugin プラグイン OPTIONS 例: python CVE-2025-49388.py -u http://127.0.0.1/wordpress 主なオプション: Option| Description| Example ---|---|--- -u, --url| 対象のWordPress URL 必須| -u http://target.com/wordpress -un, --username| 希望するユーザー名 デフォルト: ランダム| -un admin1337 -fn,...

CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

CVE-2026-101147

The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...

CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...