SSI-CVE-2022-21661

SSI-CVE-2022-21661 Information System's Security 2nd Assignment Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3. Configuring the environment To start and configure the environment, you should just run:...

typehub-exploiter

typehub-exploiter GILANG - Exploiter for CVE-2021-25094 referrence : https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ payload : site.com/wp-admin/admin-ajax.php bug path : site.com/wp-content/uploads/typehub/custom/ Thanks to : Ibnudz, Dark clown security greetz : Garuda...

CVE-2024-2961

Buddyforms 2.7.7 CNEXT RCE Abusing CVE-2024-2961 and CVE-2023–26326 to RCE Usage git-clone https://github.com/suce0155/CVE-2024-2961buddyforms2.7.7 pip install -r requirements.txt python3 buddyforms2.7.7cnextexploit.py http://site/wp-admin/admin-ajax.php ip port Analysis and Technical Details Che...

CVE-2026-109998

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

EUVD-2026-102647

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentication Bypass PoC Description Simple Proof of Concept for CVE-2026-1729 PoC - Authentication bypass vulnerability in AdForest WordPress Theme. Authored by f3ds cr3w est 2oo2 blog Features ✅ Direct admin access without credentials ✅ Works on production...

FreePBX-SQLi-RCE

FreePBX CVE-2025-57819 - Unauthenticated SQLi to RCE PoC Educational & Security Research Only - See Legal Notice Below Exploitation proof of concept for CVE-2025-57819, a critical unauthenticated SQL injection vulnerability in FreePBX that allows remote code execution. This PoC is published after...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

freepbx-rce-detector Triage scanner for CVE-2025-57819, t...

VulnCheck KEV: CVE-2026-4815

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls0messageids' parameter in '/supportboard/include/ajax.php' endpoint...

Exploit for CVE-2025-58226

CVE-2025-58226 — 3D FlipBook ≤ 1.16.16 Unauthenticated Sensiti...

Exploit for CVE-2026-81780

CVE-2026-81780 — Hash Form ≤ 1.4.2 Unauthenticated RCE !CVE...

Exploit for CVE-2026-15989

█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗...

Exploit for CVE-2026-96349

CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...

CVE-2026-84279

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outputformat' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Exploit for CVE-2026-17089

CVE-2026-17089 — Events Manager is in the response == RESU...

EUVD-2026-83616

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...