CVE-2018-7600

TRAN CONG DANH - SVTT - المرشد: LUU VAN LAN - CVE-2018-7600 - تاريخ البدء: 26/06/2024. جدول المحتويات: 1. ملخص CVE 2. المتطلبات الأساسية 3. تحليل CVE 4. التخفيف ملخص CVE يمكن للمهاجم استدعاء طلب Ajax من Drupal Form API يحتوي على دالة calluserfunc للتنفيذ التلقائي دروبال قبل 7.58، و8.x قبل 8.3.9،...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — RCE não autenticado via calluserfunc sem Allowlist Resumo da Vulnerabilidade Vulnerabilidade de Remote Code Execution RCE sem autenticação no plugin Avada Builder Fusion Builder versão = 3.15.2 usado pelo tema WordPress Avada — um dos temas premium do...

CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ 인증되지 않은 calluserfunc를 통한 RCE ║ ╚══════════════════════════════════════════════════════════════╝ 📋 요약...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework , | | | \ / | | / /| || / / | | | | | / / | / || |||/|/ // / //...

CVE-2025-3776

CVE-2025-3776 - Esecuzione Remota di Codice nel Plugin "Verification SMS with TargetSMS" = 1.5 Informazioni sul Plugin Nome Plugin: Verification SMS with TargetSMS Versioni Vulnerabili: = 1.5 CVE ID: CVE-2025-3776 Tipo: Esecuzione Remota di Codice RCE Classificazione OWASP: A1: Injection Severità...

CVE-2022-35914_poc

CVE-2022-35914poc Modificato per GLPI Offsec Lab: calluserfunc, arraymap, passthru Riferimenti Modificato per funzionare per il Proving Grounds Practice Lab: GLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr...

CVE-2026-9009

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

CVE-2026-7465

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server...

CVE-2026-9009

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...

WordPress plugin Avada (Fusion) Builder 注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...

The vulnerability of the `call_user_func` function in the LearnPress plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the calluserfunc function in the LearnPress plugin of the WordPress content management system is related to the lack of data cleansing at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through getcontent...

WordPress Marketplace 2.4.0 Arbitrary File Download

Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9013 and CVE-2014-901...

WordPress Plugin Marketplace 2.4.0 - Arbitrary File Download

Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download Date: 26-10-2014 Software Link: https://wordpress.org/plugins/wpmarketplace/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9013 and CVE-2014-901...

WordPress Download Manager 2.7.4 Remote Command Execution

!/usr/bin/python Exploit Name: Wordpress Download Manager 2.7.0-2.7.4 Remote Command Execution Vulnerability discovered by SUCURI TEAM http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html Exploit written by Claudio Viviani 2014-12-03: Discovered...

CVE-2014-2988

EGroupware Enterprise Line EPL before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the calluserfunc PHP function, as demonstrated using th...

Horde Framework Unserialize PHP Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Horde Framework Unserialize PHP Code Execution', 'Description' = %q This module exploits a php unserialize vulnerability in Horde...