semgrep-rules

semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...

Typecho-Multiple-Vulnerabilities

Множественные уязвимости Typecho Этот репозиторий содержит эксплойты для следующих уязвимостей: CVE-2024-35538: В Typecho v1.3.0 существует уязвимость спуфинга IP-адреса клиента, которая позволяет злоумышленникам подделывать свои IP-адреса, указывая произвольный IP-адрес в качестве значения...

CVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

EUVD-2026-57217

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-67287: Improper Access Control

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

PT-2026-65382

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...

WordPress Multicollab: Content Team Collaboration and Editorial Workflow plugin <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment vulnerability

Missing Authorization to Authenticated Subscriber+ Collaboration Comment vulnerability discovered by Jigar Bhanushali Jigar787 - https://jigarbhanushali.com/ in WordPress Plugin Multicollab – Google Doc-Style Editorial Commenting for WordPress versions = 5.2...

CVE-2025-63293

FairSketch Rise Ultimate Project Manager & CRM version 3.9.4 is vulnerable to Insecure Permissions due to a lack of authorization checks in the ticketing/commenting API . A remote authenticated user can exploit this flaw to append comments or upload attachments to tickets for which they lack the ...

CVE-2025-63293: Missing Authorization

FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API...

EUVD-2010-4851

Malware in sbrugna...

EUVD-2017-9232

Malware in sbrugna...

EUVD-2019-6667

Malware in sbrugna...

EUVD-2012-0356

Malware in sbrugna...

EUVD-2025-20284

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-28036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. CVE-2020-28036 Note...

WordPress Muut – Commenting and Forums Re-Imagined plugin <= 3.0.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Muut – Commenting and Forums Re-Imagined versions = 3.0.6...

PT-2024-39047 · WordPress · Special Text Boxes

Name of the Vulnerable Software and Affected Versions: The Special Text Boxes plugin for WordPress versions up to and including 6.2.2 Description: The issue is related to arbitrary shortcode execution. This is due to the plugin adding the filter add filter'comment text','do shortcode';, which run...

CVE-2024-35539

Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently...