404 matches found
CVE-2024-9796
CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5×tamp=13672261755853'...
WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
twitter-advanced-search
🔍 Twitterの高度な検索 これらのオペレータはWeb、モバイル、Tweetdeckで動作します。 一部重複はありますが、これらのほとんどはv1.1 Search、Premium Search、またはv2 SearchのAPIでは機能しません 。 出典: TweetDeck Help、@lucahammer ガイド、@eevee Twitterマニュアル、@pushshift および Twitter/Tweetdeck 自体。コントリビューション/テスト/例歓迎！Class| Operator| 検出するツイート…| 例: ---|---|---|--- ツイート内容| nasa e...
CVE-2025-39538
🛡️ CVE-2025-39538 - WordPress WP-Advanced-Search = 3.3.9.3 任意文件上传 CVE-2025-39538 发布日期： 2025-04-16 漏洞类型： 任意文件上传（危险类型文件未限制上传） 受影响插件： Mathieu Chartier 开发的 WP-Advanced-Search 受影响版本： 所有版本直至 3.3.9.3（含） 此漏洞允许已认证的攻击者利用插件提供的导入功能，向服务器上传恶意 PHP 文件（例如 Web Shell）。上传的文件位于 WordPress 上传目录下，可能导致远程代码执行。 🧱 上传路径：...
CVE-2024-9796
CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - 未认证SQL注入 描述 PoC SQL注入将转储WordPress用户和哈希。 免责声明： 此脚本仅供教育用途。 请勿用于非法目的。 如果使用，完全由您负责；我不对任何滥用负责。 关于该漏洞的更多信息 https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b/ 用法： root@kitploit: 成功尝试 python3 poc.py -i 127.0.0.1 ! 127.0.0.1 has been PWNed!...
CVE-2024-9796
CVE-2024-9796 PoC SQLi - CVE-2024-9796 针对 CVE-2024-9796 漏洞的功能性 PoC，该漏洞影响 WordPress 的 WP Advanced Search（自动补全）插件，允许通过未净化的 GET 参数进行 SQL 注入。 📌 描述 该漏洞允许攻击者通过自动补全端点的 t 参数注入任意 SQL 查询： /wp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php ⚠️ 仅限教育用途及授权环境使用 。 🧰 要求 Python...
CVE-2022-47447
CVE-2022-47447 POC CSRF - CVE-2022-47447 ⚠️ 仅限教育用途和授权环境使用。 针对CVE-2022-47447漏洞的功能性PoC，该漏洞影响一个易受攻击的WordPress插件，允许对经过身份验证的用户发起跨站请求伪造（CSRF）攻击。 VULNERABLE URL: /wp-admin/admin.php?page=WPAdvancedSearchCallbackStyles...
EUVD-2026-67564
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
CVE-2026-4246 ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...
CVE-2026-13253
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
EUVD-2026-42520
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-13253
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-13253 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-50235
Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScri...
CVE-2026-30139
A reflected cross-site scripting XSS vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input...
CVE-2026-50235 Lyrion Music Server 9.2.0 Reflected XSS via search Parameters
Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScri...
CVE-2026-50235 Lyrion Music Server 9.2.0 Reflected XSS via search Parameters
Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScri...
CVE-2026-50235
Affected software: Lyrion Music Server 9.2.0. Vulnerability: reflected XSS in advanced search parameters that fail to sanitize user input before displaying it in search forms. Impact: can execute arbitrary JavaScript in users’ browsers and potentially steal session information. Exploitation/Detai...
EUVD-2026-34834
Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScri...
📄 Lyrion Music Server 9.2.0 search Cross Site Scripting
Lyrion Music Server version 9.2.0 has advanced search parameters that are stuffed back into the page so the form keeps its values. Several free-text fields do not apply filtering, resulting in reflected cross site scripting. Lyrion Music Server 9.2.0 search. Multiple Script Insertions Vendor: LMS...