CVE-2026-19991

CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...

CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

EUVD-2026-75939

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

EUVD-2026-75954

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

kenzer

KENZER - 自動化されたWebアセットの列挙とスキャン 非推奨 メンション バグ報奨金自動化の概念的な入門 デモ スクリーンショット 実行手順 0. git clone https://github.com/ARPSyndicate/kenzer /home/ubuntu/kenzer && cd /home/ubuntu/kenzer を実行してください 推奨 1. Zulipでアカウントを作成してください。 2. Settings Your Bots Add a new bot に移動してください。 3. kenzerという名前の新しい汎用ボットを作成してください。 4...

syntribos

团队和仓库标签 .. image:: http://governance.openstack.org/badges/syntribos.svg :target: http://governance.openstack.org/reference/tags/index.html .. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat :target: http://docs.openstack.org/developer/syntribos/ .. image::...

CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e root@kitploit: python3 kc-resetforge.py -h usage: kc-resetforge.py -h --target TARGET --targets-file TARGETSFILE --port PORT --realm REALM --client-id...

Red-Team-Infrastructure-Wiki

本维基旨在为搭建具有韧性的红队基础设施提供资源。它是为了补充 Steve Borosh（@424f424f）和 Jeff Dimmock（@bluscreenofjeff）在 BSides NoVa 2017 上的演讲“末日准备者：强化你的红队基础设施”（幻灯片）而创建的。 如果您想添加内容，请在仓库中提交 Pull Request 或提交 issue。 感谢本维基中所有引用内容的作者，以及所有贡献者！ 目录 设计考量 功能隔离 使用重定向器 示例设计 更多资源 域名 分类与黑名单检查资源 钓鱼 简易基于 Web 的钓鱼 Cobalt Strike 钓鱼 Evilginx 本地部署 钓鱼...

exist

EXIST（外部信息聚合系统应对网络威胁） ⚠️ 此仓库已停止维护/归档。安全问题将不会被修复。 EXIST 是一个用于聚合和分析 CTI（网络威胁情报）的 Web 应用程序。 EXIST 由以下软件编写： Python 3 Django 1.11 概念 EXIST 是一个用于聚合 CTI 的 Web 应用程序，旨在帮助安全运维人员根据相关指标调查事件。 EXIST 通过 API 和订阅源自动从多个 CTI 服务和 Twitter 获取数据。 您可以通过 Web 界面和 API 进行交叉搜索指标。 如果您有记录客户端网络行为的服务器（例如 DNS 和 HTTP...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

frida-fuzzer

Frida API Fuzzer v1.4 Copyright C 2020 Andrea Fioraldi [email protected] Released under the Apache License v2.0 This experimental fuzzer is meant to be used for API in-memory fuzzing. The design is highly inspired and based on AFL/AFL++. ATM the mutator is quite simple, just the AFL's havoc...

path-auditor

PathAuditor The PathAuditor is a tool meant to find file access related vulnerabilities by auditing libc functions. The idea is roughly as follows: Audit every call to filesystem related libc functions performed by the binary. Check if the path used in the syscall is user-writable. In this case a...

widevine-l3-decryptor

Deprecation Warning This repository used to contain code to circumvent Widevine L3 DRM in Chrome on Windows machines. It's not working anymore as of May 31st 2021, but you can read the reversing writeup. Update Google issued a DMCA takedown request against most forks of this repository. The...

pyre-check

!WARNING This Repository Is Archived This repository is no longer maintained and has been archived. Type checking: Pyre has been replaced by Pyrefly, our next-generation Python typechecker and language server. Security analysis Pysa: Pysa has moved to its own repository at github.com/facebook/Pys...

lockphish

Lockphish v2.0 Lockphish it's the first tool 07/04/2020 for phishing attacks on the lock screen, designed to grab Windows credentials, Android PIN and iPhone Passcode using a https link. LockPhish Tutorial: https://www.kalilinux.in/2020/05/lockphish.html Author: The Linux Choice Who deleted his...

Multiple vulnerabilities in OpenSSH affect AIX

IBM SECURITY ADVISORY First Issued: Fri Sep 11 03:21:05 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory22.asc Security Bulletin: Multiple vulnerabilities in OpenSSH affect AIX...