421 matches found
WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
twitter-advanced-search
🔍 Advanced Search on Twitter These operators work on Web, Mobile, Tweetdeck. There is some overlap, but largely these will not work for v1.1 Search, Premium Search, or v2 Search APIs. Adapted from TweetDeck Help, @lucahammer Guide, @eevee Twitter Manual, @pushshift and Twitter / Tweetdeck itself...
CVE-2024-9796
CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5×tamp=13672261755853'...
CVE-2024-9796
CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Unauthenticated SQL Injection Description The PoC SQL injection will dump WordPress users and hashes. Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable f...
CVE-2024-9796
CVE-2024-9796 PoC SQLi - CVE-2024-9796 针对 CVE-2024-9796 漏洞的功能性 PoC，该漏洞影响 WordPress 的 WP Advanced Search（自动补全）插件，允许通过未净化的 GET 参数进行 SQL 注入。 📌 描述 该漏洞允许攻击者通过自动补全端点的 t 参数注入任意 SQL 查询： /wp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php ⚠️ 仅限教育用途及授权环境使用 。 🧰 要求 Python...
CVE-2022-47447
CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ 仅限教育用途和授权环境使用。 针对CVE-2022-47447漏洞的功能性PoC，该漏洞影响一个易受攻击的WordPress插件，允许对经过身份验证的用户发起跨站请求伪造（CSRF）攻击。 VULNERABLE URL: /wp-admin/admin.php?page=WPAdvancedSearchCallbackStyles...
CVE-2025-39538
🛡️ CVE-2025-39538 - WordPress WP-Advanced-Search = 3.3.9.3 任意文件上传 CVE-2025-39538 发布日期： 2025-04-16 漏洞类型： 任意文件上传（危险类型文件未限制上传） 受影响插件： Mathieu Chartier 开发的 WP-Advanced-Search 受影响版本： 所有版本直至 3.3.9.3（含） 此漏洞允许已认证的攻击者利用插件提供的导入功能，向服务器上传恶意 PHP 文件（例如 Web Shell）。上传的文件位于 WordPress 上传目录下，可能导致远程代码执行。 🧱 上传路径：...
GitLab 12.3 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-88765)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve...
CVE-2026-68529
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
EUVD-2026-79184
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
CVE-2026-68529
Concrete CMS 9.0.0 through 9.5.2 contained an authorization bypass in the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity from a user-supplied entity ID without invoking canViewExpressEntries(), ...
CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
CVE-2026-88765
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...
EUVD-2026-78869
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...
CVE-2026-88765 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...
CVE-2026-88765 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...
CVE-2026-88765
GitLab EE versions 12.3 through 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by a buffer overflow in the Unicode conversion buffer used in Advanced Search indexing . An authenticated user can achieve remote code execution by importing a specially crafted Git project export. T...
PT-2026-92400
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced search method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...