96 matches found
The vulnerability of the Bricks Builder plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the Bricks Builder plugin of the WordPress content management system is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Exploit for CVE-2024-25600
CVE-2024-25600 - WordPress Bricks Builder Remote Code Executio...
Imperva successfully defends against CVE-2024-25600 in WordPress Bricks Builder
A critical vulnerability in the Bricks Builder site builder for WordPress, identified as CVE-2024-25600, is currently under active exploitation, and poses a significant threat to over 25,000 sites. This flaw, with a CVSS score of 9.8, is an unauthenticated remote code execution vulnerability that...
Exploit for CVE-2024-25600
CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️...
Exploit for CVE-2024-25600
CVE-2024-25600Nuclei-Template Nuclei template and information...
Exploit for CVE-2024-25600
CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️...
Unauthenticated RCE in Bricks Builder Theme
This module exploits an unauthenticated remote code execution vulnerability in the Bricks Builder Theme versions use exploit/multi/http/wp/bricksbuilderrce msf undefinedbricksbuilderrce show actions ...actions... msf undefinedbricksbuilderrce set ACTION msf undefinedbricksbuilderrce show options...
VulnCheck KEV: CVE-2024-25600
Remote Code Execution vulnerability in Bricks Builder Theme preparequeryvarsfromsettings function...
WordPress Bricks Builder Theme <= 1.9.6 is vulnerable to Remote Code Execution (RCE)
Software Bricks Builder Type Theme Vulnerable versions = 1.9.6 Fixed in 1.9.6.1 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-25600 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 58c6c492a8d0 Credits Snicco Required privilege...
PT-2024-2333
Name of the Vulnerable Software and Affected Versions Bricks Builder versions 1.9.6 and earlier Description A critical remote code execution vulnerability in Bricks Builder, a WordPress site builder, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable installations. This...
WordPress Bricks Builder premium theme <= 1.5.3 - Auth. Arbitrary Post/Page Edition vulnerability
Auth. Arbitrary Post/Page Edition vulnerability discovered by RG in WordPress Bricks Builder premium theme versions = 1.5.3. Solution Update the WordPress Bricks Builder theme to the latest available version at least 1.5.4...
WordPress Bricks Builder premium theme <= 1.5.3 - Auth. Remote Code Execution vulnerability
Auth. Remote Code Execution vulnerability discovered by RG in WordPress Bricks Builder premium theme versions = 1.5.3. Solution Update the WordPress Bricks Builder theme to the latest available version at least 1.5.4...
Bricks Builder < 1.5.4 - Subscriber+ Arbitrary Post/Page Edition
The theme does not have authorisation in an AJAX action, which could allow any authenticated users such as subscriber to call it and edit any page, post, or template on the blog 1. Start with a clean Wordpress install 2. Install Bricks builder v1.5.3 3. Enable registrations on the website 4...
Bricks Builder < 1.5.4 - Subscriber+ Remote Code Execution
The theme allows website editors to include executable code blocks in their website, which can contain arbitrary PHP code. By default, code execution is intended to be disabled, with website administrators having to explicitly allow code execution for specific user roles. However, due to improper...
Bricks Builder < 1.5.4 - Subscriber+ Arbitrary Post/Page Edition
The theme does not have authorisation in an AJAX action, which could allow any authenticated users such as subscriber to call it and edit any page, post, or template on the blog PoC 1. Start with a clean Wordpress install 2. Install Bricks builder v1.5.3 3. Enable registrations on the website...
Bricks Builder < 1.5.4 - Subscriber+ Remote Code Execution
The theme allows website editors to include executable code blocks in their website, which can contain arbitrary PHP code. By default, code execution is intended to be disabled, with website administrators having to explicitly allow code execution for specific user roles. However, due to improper...