challenges

Hex Advent CTF ДОБРО ПОЖАЛОВАТЬ В HEX ADVENT 2025, время раскрыть свой потенциал! 🎁 HEX ADVENT 2025 — это рождественский адвент-календарь CTF, созданный женщинами для женщин. 12 дней, 12 заданий: структурированный график для освоения различных категорий CTF. Направления root@kitploit: - Pwn Binar...

CVE-2023-35636

CVE-2023-35636 Уязвимость Microsoft Outlook, приводящая к раскрытию информации утечка хэша пароля - Expect Script POC CVE-2023-35636 — эксплойт функции общего доступа к календарю в Microsoft Outlook, при котором добавление двух заголовков к электронному письму заставляет Outlook предоставить общи...

CVE-2026-49772

PoC внедрения SQL в The Events Calendar CVE-2026-49772 Описание CVE-2026-49772 — это неаутентифицированная слепая SQL-инъекция в плагине WordPress The Events Calendar. Некорректный валидатор параметров REST validatecallback возвращает замыкание вместо проверки позволяет параметру order в...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Неаутентифицированная SQL-инъекция через meclistloadmore attsinclude / attsexclude Краткое описание...

ics-phishing-toolkit

ics-phishing-toolkit Этот набор инструментов для исправления вредоносных приглашений в календаре предназначен для команд, использующих решения для обеспечения безопасности электронной почты, которые изначально не исправляют такие атаки. Если вы используете Sublime, этот набор инструментов вам не...

CVE-2026-93655

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbcautofill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93655

The Booking Calendar WordPress plugin is affected by a Reflected Cross-Site Scripting vulnerability via the wpbc_auto_fill parameter in all versions up to and including 11.8.3 . The root cause is insufficient input sanitization and output escaping . An unauthenticated attacker can inject arbitrar...

CVE-2023-23397-PoW

CVE-2023-23397-PoW Доказательство работоспособности CVE-2023-23397 для уязвимого клиентского приложения Microsoft Outlook. Только для образовательных и исследовательских целей. Обзор CVE-2023-23397 Эта CVE направлена на получение хэша NetNTLM вошедшего в систему пользователя из клиента Microsoft...

CVE-2021-24145

CVE-2021-24145 Уязвимость загрузки файлов в WordPress, плагин Modern Events Calendar Lite для WordPress до версии 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Порядок установки и запуска 1. Установка WordPress При установке выполните проброс портов в файле docker-compose.yml...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

Webnus Inc. Modern Events Calendar - Broken Access Control

Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. id: CVE-2026-32583 info: name: Webnus Inc. Modern Events...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

WordPress Spider Calendar <=1.4.9 - SQL Injection

WordPress Spider Calendar plugin through 1.4.9 is susceptible to SQL injection. An attacker can execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php, thus making it possible to obtain sensitive information, modify data, and/or execut...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

WordPress My Calendar <= 3.1.9 - Cross-Site Scripting

WordPress plugin My Calendar = 3.1.10 or apply the vendor-provided patch to fix the XSS vulnerability. reference: - https://wpscan.com/vulnerability/9267 - https://wordpress.org/plugins/my-calendar/developers - https://nvd.nist.gov/vuln/detail/CVE-2019-15713 -...