CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc إعداد بيئة الاختبار بعد تشغيل حاوية docker، لا تزال هناك بعض الإعدادات المطلوبة قم بزيارة 127.0.0.1:8080، وبعد إكمال الإعداد في لوحة التحكم - المظهر - السمات، حدد سمة، ثم قم بتخصيصها وإعدادها انتقل إلى التصميم - القوالب - المقالة الفردية اختر الصورة...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Ensuite, consultez l'article publié par l'auteur pour déclencher le XSS. Vidéo POC : https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2021-24545

CVE-2021-24545 ثغرة XSS تم اكتشافها في إضافة تم إيقاف توزيعها كإضافة حاليًا. WordPress Plugin HTML Author Bio description XSS تحدث هذه الثغرة بسبب التحقق غير المناسب من معامل الوصف description في /wp-admin/profile.php. يمكن لمهاجم عن بعد إرسال طلب HTTP تم التلاعب به بشكل ضار لاستغلال الثغرة. ترتي...

CVE-2026-84930

CatFolders Document Gallery & PDF Library for WordPress, in versions before 2.0.7 , suffers from a stored cross-site scripting (XSS) vulnerability caused by improper validation of the titleTag block attribute before it is used as an HTML tag name in gallery output. Any user with the Author role o...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

CVE-2026-84931

The Joli Table of Contents WordPress plugin (before 3.0.3 ) contains a stored XSS vulnerability in its shortcode handler. The plugin fails to sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute. This allows users with the Author role (or above) t...

WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...

EUVD-2026-71871

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

AeroCMS 0.1.1 - SQL Injection

AeroCMS 0.1.1 contains a SQL injection caused by unsanitized author parameter, letting attackers execute arbitrary SQL commands, exploit requires crafted author input. id: CVE-2022-38812 info: name: AeroCMS 0.1.1 - SQL Injection author: shivampand3y severity: medium description: | AeroCMS 0.1.1...

WordPress_4.9.8_RCE_POC

सारांश WordPress RCE लेखक विशेषाधिकार के लिए एक सरल PoC, CVE-2019-8942 और CVE-2019-8943 देखें। प्रभावित संस्करण WordPress = 4.9.8 सत्यापित WordPress = 5.0.0 परीक्षण वातावरण Docker इमेज docker pull avfisherdocker/wordpress:4.9.8 docker run -d -p 80:80 avfisherdocker/wordpress:4.9.8 MySQL और...

presentations

عروض تقديمية من Jorge Orchilles...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: root@kitploit: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to u...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

openstego

OpenStego OpenStego is a steganography application that provides two functionalities: 1. Data Hiding: It can hide any data within an image file. 2. Watermarking: Watermarking image files with an invisible signature. It can be used to detect unauthorized file copying. Usage For GUI: Use menu...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...