WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

CVE-2022-22954

Detecção de múltiplos pontos de gatilho de vulnerabilidade, detecção em lote multithread, execução de comandos, escrita de arquivos root@kitploit: // 单个目标漏洞检测 python CVE-2022-22954.py -u https://x.x.x.x // 命令执行 python CVE-2022-22954.py -u https://x.x.x.x -c "id" // 写文件 python CVE-2022-22954.py -u...

The vulnerability of the iFlightDoc onboard documentation system, related to incorrect restrictions on the path name to the catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

VMware-CVE-2022-22954

VMware CVE-2022-22954 Workspace ONE Access Freemarker Serverseitige Template-Injection POC für VMware CVE-2022-22954 Verwenden Sie diese einzeilige GET-Anfrage!! Dadurch wird cat /etc/passwd ausgeführt...

CVE-2026-66384

creationtimestamp| type| source ---|---|--- 2026-08-27 17:44:46+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mu3fm5paxf24 2026-08-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d46c9d24-f8e3-4328-8a89-6da9954a94e6...

reproducer-okio-cve-2023-3635

reproducer-okio-cve-2023-3635 Cosa riproduce questo progetto Reproducer per facebook/react-native58148: il file packages/react-native/gradle/libs.versions.toml di React Native fissa okhttp = "4.9.2" / okio = "2.9.0", e okio 2.9.0 è affetto da CVE-2023-3635 / GHSA-w33c-445m-f8w7, corretta in okio...

CVE-2026-33310

CVE-2026-33310 CVE-2026-33310 Iniezione di comandi tramite espansione shell nei valori predefiniti dei parametri Riepilogo La sintassi shell all'interno dei valori predefiniti dei parametri sembra essere espansa automaticamente durante il processo di parsing del catalogo. Se un catalogo contiene ...

CVE-2022-22954

CVE-2022-22954 Achtung Bitte verwenden Sie dies auf eigenes Risiko. Dieses Repository dient ausschließlich Bildungszwecken, und wir sind strikt gegen alle illegalen Absichten. Wir übernehmen keine Verantwortung für illegale Aktivitäten im Zusammenhang mit diesem Repository. Seien Sie ethisch!...

smart-contract-attack-vectors

نواقل هجمات العقود الذكية الهدف من هذا المستودع هو جمع جميع الثغرات المحتملة في العقود الذكية والموارد اللازمة لتعلّمها. لا تتردد في تقديم طلب سحب Pull Request بأي شيء، من إصلاحات صغيرة إلى مستندات أو أدوات تود إضافتها. قائمة الثغرات الأمنية التحكم في الوصول المصادقة باستخدام tx.origin الرؤية...

VMware-CVE-2022-22954-Command-Injector

VMware-CVE-2022-22954-Command-Injector VMware CVE-2022-22954 악용을 위한 개념 증명Proof of Concept 작동 방식 이 간단한 Python 스크립트는 지정된 URL에 /catalog-portal/ui/oauth/verify?error=&deviceUdid=를 추가한 뒤, 그 다음에 다음 문자열의 URL 인코딩 버전을 붙여 GET 요청을 보냅니다: root@kitploit: $"freemarker.template.utility.Execute"?new"command" 예를 들...

owasp-istg

Guida OWASP ai Test di Sicurezza dell'IoT La Guida OWASP ai Test di Sicurezza dell'IoT fornisce una metodologia completa per i test di penetrazione nel campo dell'IoT, offrendo flessibilità per adattarsi a innovazioni e sviluppi del mercato IoT, garantendo al contempo la comparabilità dei risulta...

cve-2022-22954

CVE-2022-22954 Ce paquet détecte un sous-ensemble de tentatives et d'exploitations de la CVE-2022-22954, génère une notification, et inclut également l'URI de l'exploit et les premiers 4 Ko des données renvoyées à l'attaquant en réponse. Alors que la détection de cette attaque est plus simple à...

reproxy

Reproxy è un semplice server HTTPs di perimetro / proxy inverso che supporta vari provider docker, static, file, consul catalog. Uno o più provider forniscono informazioni sul server richiesto, l'URL richiesto, l'URL di destinazione e l'URL di health check. È distribuito come singolo binario o co...

linux-malware

linux-malware Vista scorrevole degli aggiornamenti degli ultimi 7 giorni da questo repository Proposte? Stampa/accademia https://en.wikipedia.org/wiki/Linuxmalware 17 - Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement,...

bumblebee

Cataloghi di esposizione di Threat Intelligence Cataloghi di esposizione mantenuti per campagne recenti della supply-chain, costruiti a partire da report pubblici di threat intelligence con Perplexity Computer e aggiornati tramite PR man mano che vengono segnalate nuove campagne. Passa un catalog...

CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128

The eCommerce Product Catalog WordPress plugin (all versions up to 3.5.10 ) is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitr...

EUVD-2026-65357

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...