737 matches found
study-turbolinks-link
JavaScript Usage https://github.com/turbolinks/turbolinksapi-reference Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...
sh4d0wup
sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...
Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection
Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-esclike which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter. id: CVE-2026-5607...
Advance Post Prefix WordPress plugin - Reflected XSS
Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12734 info: name: Advance...
Advanced Custom Fields < 6.1.6 - Cross-Site Scripting
Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...
CVE-2021-41822
CVE-2021-41822（水的一个） Canon printer unauthorized access vulnerability and denial of service vulnerability The attacker does not need an account or password to access the printer page and obtain information about printed files. And the printer can be turned off remotely. Create denial of service...
CVE-2026-118063
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachab...
CVE-2026-118064
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute...
CVE-2026-118065
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their file...
EUVD-2026-124840
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their file...
CVE-2026-118064
The Advance Guest Post WordPress plugin, versions through 1.9 , contains a vulnerability where it fails to properly restrict or validate file uploads. The application uses a nonce exposed to all front-end visitors and only verifies a file's leading bytes, enabling unauthenticated users to upload ...
CVE-2026-118065
The Advance Guest Post WordPress plugin (version 1.9 and below ) is vulnerable to unauthenticated deletion of media attachments. The root cause is a lack of authorization or ownership checks during the deletion process, as the plugin relies solely on a nonce that is accessible to all site visitor...
EUVD-2026-124839
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute...
CVE-2026-118065 Advance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment Deletion
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their file...
CVE-2026-118064 Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_action
The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP files and execute...
CVE-2026-118063
The Advance Guest Post WordPress plugin, affecting versions through 1.9 , contains a vulnerability where it fails to properly validate uploaded files. The root cause is an incomplete and case-sensitive extension check that can be bypassed by unauthenticated users. This flaw allows for the unauthe...
CVE-2026-118063 Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachab...
EUVD-2026-124838
The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, into a web-reachab...
PT-2026-146413
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their file...
