WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Stored Cross-Site Scripting via arbitrary URL injection in versions up to and including 6.1 and 1.0 respectively. Authenticated users with author-level permissions can inject arbitrary remote URLs for SVG map files. When a user...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...

lighthouse

Lighthouse - A Coverage Explorer for Reverse Engineers Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This...

CVE-2026-126373

The Vvveb software, versions 1.0.8.4 through 1.0.8.6 , is susceptible to an authorization bypass vulnerability within the content/revisions revision action. The root cause is that the revision() action fails to enforce an admin_id ownership restriction . This allows low-privileged Authors to acce...

CVE-2026-126376 Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets

Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing adminid owner scoping. Attackers can supply filteradminid to list drafts, invoke duplicate on posts or products, or enumerate every...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

netzob

=========================================================== Netzob : Protocol Reverse Engineering, Modeling and Fuzzing .. image:: https://img.shields.io/badge/Python-3-brightgreen.svg :target: https://github.com/netzob/netzob :alt: Python3 See complete documentation here:...

CVE-2026-97160

CVE-2026-97160 — UP Plugin PHP Code Injection Joomla Python 3 PoC for CVE-2026-97160 — UP Universal Plugin for Joomla lomart.fr / up.lomart.fr. Description PoCbit / GitHub CVE-2026-97160 — UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 allow PHP code injection through up php=... shortcodes processed with...

CVE-2026-125398

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...

CVE-2026-121560

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

EUVD-2026-115905

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

WordPress Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by muhammad nizar in WordPress Plugin PublishPress Authors versions = 4.17.0...

CVE-2026-111592

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2026-111592 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2026-111592 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

EUVD-2026-114646

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2026-111592

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.17.0 . The flaw exists in the Co-Authors, Multiple Authors, and Guest Authors components due to insufficient input sanitization and output escaping of the 'name (...

PT-2026-134426

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls an...