53 matches found
CVE-2025-13486
CVE-2025-13486 漏洞利用 ACF Extended WordPress 插件 — 远程代码执行与权限提升 针对 CVE-2025-13486 的漏洞利用，由 Marcin Dudek dudekmar 发现 ⚠️ 免责声明 本仓库仅用于研究和防御性安全目的 。 作者对本信息的滥用不承担任何责任。 📌 概述 WordPress 的 Advanced Custom Fields: Extended ACFE 插件在 0.9.0.5 至 0.9.1.1 版本中存在远程代码执行 RCE 漏洞。 该漏洞存在于 prepareform...
CVE-2025-13486
批量利用 CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - 在 prepareform 中未经认证的远程代码执行 ⚠️ 漏洞详情 WordPress 的 Advanced Custom Fields: Extended 插件在 0.9.0.5 至 0.9.1.1 版本中存在远程代码执行漏洞，问题出在 prepareform 函数。该函数接受用户输入并将其传递给 calluserfuncarray，因而容易受到攻击。这使得未经认证的攻击者能够在服务器上执行任意代码，进而可用于注入后门或创建新的管理员用户账户...
cve-2025-13486-vuln-setup
CVE-2025-13486 漏洞测试环境 用于测试 ACF Extended RCE 漏洞的一键式 Docker 环境。 快速开始 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u http://localhost:8888 手动插件设置 如果下载脚本失败，请手动将这些文件放到 plugins...
CVE-2026-65008
CVE-2026-65008 — Grav CMS 2.0.7 认证 RCE CVE-2026-65008 的概念验证：通过 Blueprint::dynamicData 中不受限制的 calluserfuncarray，在 Grav CMS 中实现认证远程代码执行。 拥有 admin.pages（或 api.pages.write）权限的用户可以植入恶意表单 frontmatter。当任何 访客（包括未认证用户）加载页面时，该载荷将以 Web 服务器用户身份执行。 仅限授权测试。 仅可用于您拥有或已获得明确书面许可进行测试的系统。 致谢 角色| ---|--- 漏洞报告者|...
CVE-2025-13486-POC
CVE-2025-13486 概念実証 CVE-2025-13486 の概念実証 PoC エクスプロイトです。WordPress プラグイン Advanced Custom Fields: Extended ACFE のリモートコード実行脆弱性です。 脆弱性の概要 この脆弱性は、ACFE バージョン 0.9.0.5 から 0.9.1.1 に存在し、認証されていない攻撃者が acfe/form/renderformajax AJAX アクションを介して任意の PHP 関数を実行できるようにします。プラグインは、適切な検証なしにユーザーが指定した入力で calluserfuncarray...
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...
GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...
EUVD-2026-62549
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData...
GHSA-FJ2P-QJ2F-74V5 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Summary An account with the admin.pages permission or api.pages.write can run shell commands on the server. The command executes whenever anyone — including an unauthenticated visitor — opens the page. Details Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php:426 passes a...
CVE-2026-64850
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...
CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...
CVE-2026-64850
In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...
CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...
CVE-2026-64850: Improper Control of Generation of Code
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...
CVE-2026-14498
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...
CVE-2026-14498
Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...
EUVD-2026-59852
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...