30 matches found
CVE-2026-6279
CVE-2026-6279 Avada Builder = 3.15.2 โ ๆช่ฎค่ฏRCE ้่ฟๆ ็ฝๅๅ็ calluserfunc ๆผๆดๆฆ่ฟฐ ่ฟ็จไปฃ็ ๆง่ก๏ผRCE๏ผๆ ้่ฎค่ฏ ๅญๅจไบ Avada Builder Fusion Builder ็ๆฌ = 3.15.2 ไธญ๏ผ่ฏฅๆไปถ็จไบ WordPress Avada ไธป้ขโโๆๆต่ก็ WordPress ้ซ็บงไธป้ขไนไธ๏ผๆฅๆ 900,000+ ๆดป่ทๅฎ่ฃ ใ ๆปๅปๅฉ็จ AJAX ๅค็ๅจ wpajaxnoprivfusiongetwidgetmarkup๏ผ่ฏฅๅค็ๅจ้่ฟ base64decode + jsondecode ๅค็ renderlogics...
CVE-2025-3776
CVE-2025-3776 - Ejecuciรณn Remota de Cรณdigo en el Plugin "Verification SMS with TargetSMS" = 1.5 Informaciรณn del Plugin Nombre del Plugin: Verification SMS with TargetSMS Versiones Vulnerables: = 1.5 ID CVE: CVE-2025-3776 Tipo: Ejecuciรณn Remota de Cรณdigo RCE Clasificaciรณn OWASP: A1: Inyecciรณn...
CVE-2018-7600
TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2018-7600 - Dรญa de inicio: 26/06/2024. Tabla de contenidos: 1. Resumen del CVE 2. Requisitos previos 3. Anรกlisis del CVE 4. Mitigaciรณn Resumen del CVE Un atacante podrรญa llamar a una solicitud Ajax de la API de Formularios de Drupal que contenga l...
CVE-2022-35914_poc
CVE-2022-35914poc ไธบGLPI Offsecๅฎ้ชๅฎคไฟฎๆน๏ผcalluserfunc, arraymap, passthru ๅ่ ไฟฎๆนไธบ้็จไบProving Groundsๅฎ่ทตๅฎ้ชๅฎค๏ผGLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.py...
CVE-2025-6389
CVE-2025-6389 Sneeit Framework ๐ก ไธ่ฆ้่ฟไธไธๆฌกๅๅธใ ๅจ Telegram ไธๅ ณๆณจ @KNxploited โโ ่ทๅๆๆฐๆซ้ฒ็ CVEใๅฏ็จๆผๆดๅฉ็จ็จๅบๅ้กถ็บงๅฎๅ จ็ ็ฉถ็ๆๅจ้ข้ใ็ฌฌไธๆถ้ด็ฅๆ๏ผ็ฌฌไธๆถ้ด่กๅจใ ๐ง ๆฆ่ฟฐ CVE-2025-6389 ๆฏ WordPress ็ Sneeit Framework ๆไปถไธญๅญๅจ็ไธไธช CVSS 9.8 ไธฅ้ ่ฟ็จไปฃ็ ๆง่กๆผๆดใ ่ฏฅๆผๆดๅญๅจไบ sneeitarticlespaginationcallback ๅฝๆฐไธญ๏ผ่ฏฅๅฝๆฐ็ฒ็ฎๅฐๅฐ็จๆทๆไพ็่พๅ ฅ ไผ ้็ป PHP ็...
CVE-2026-6279
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ CVE-2026-6279 ยท Avada Builder = 3.15.2 โ โ Unauthenticated RCE via calluserfunc โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ ๐ Summary Field| Detail ---|--- CVE ID| CVE-2026-6279 Affected| Avada Builder Fusio...
PT-2026-78517
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.7 Description In the Blueprint::dynamicData function located in system/src/Grav/Common/Data/Blueprint.php, the software passes an editor-controlled Class::method provider and arguments to call user func array without...
VulnCheck KEV: CVE-2026-16144
The Kali Forms โ Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...
CVE-2026-16144: Improper Control of Generation of Code
The Kali Forms โ Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...
CVE-2026-9009
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...
CVE-2026-7465
The Spectra Gutenberg Blocks โ Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server...
CVE-2026-7465: Improper Privilege Management
The Spectra Gutenberg Blocks โ Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server...
CVE-2026-9009
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filtercontent function. This is due to passing the attacker-supplied 'callbackraw' shortcode attribute directly into calluserfunc with n...
WordPress plugin Avada (Fusion) Builder ๆณจๅ ฅๆผๆด
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
CVE-2026-3584: Improper Control of Generation of Code
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'formprocess' function. This is due to the 'preparepostdata' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of...
CVE-2025-6389: Improper Control of Generation of Code
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeitarticlespaginationcallback function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for...
CVE-2025-5396: Improper Control of Generation of Code
The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackupajaxhandle function not having a capability check, nor validating user supplied input passed directly to calluserfunc. This makes it possible for...
CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...
CVE-2025-5392: Improper Control of Generation of Code
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...
CVE-2025-4208: Improper Control of Generation of Code
The NEX-Forms โ Ultimate Form Builder โ Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the gettablerecords function. This is due to the unsanitized use of user-supplied input in calluserfunc. This makes it...