misp-dashboard

misp-dashboard Un dashboard que muestra datos en vivo y estadísticas de los feeds ZMQ de una o más instancias de MISP. El dashboard puede utilizarse como una herramienta de conciencia situacional en tiempo real para recopilar información sobre amenazas. El misp-dashboard incluye una herramienta d...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — Contributor+ Stored XSS via Custom Field Meta Key | ---|--- CVE ID| CVE-2026-88997 Status| PUBLISHED CNA| WPScan Published| 2026-09-23 Updated| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS Description The JSM Show Post Metadata WordPress plugin...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia para WordPress, BuddyPress y bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor's editor sanitizes input on the client side, but the REST API endpoint /wp-json/wp/v2/posts/id accepts the elementordata meta field directly and bypasses that layer entirely. An authenticated Contributo...

CVE-2026-28134

Informe de explotación de CVE-2026-28134 JetEngine = 3.7.2 — Ejecución remota de código autenticada Colaborador+ mediante SSTI en Twig Fecha: 11 de marzo de 2026 Puntuación CVSS: 8.8 Alta Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Plugin afectado: JetEngine = 3.7.2 Slug del plugin:...

CVE-2021-42362

CVE-2021-42362 El plugin de WordPress Popular Posts es vulnerable a la subida arbitraria de archivos debido a una validación insuficiente del tipo de archivo de entrada encontrada en el archivo /src/Image.php, lo que hace posible que atacantes con acceso de nivel colaborador o superior suban...

CVE-2024-3105-PoC

CVE-2024-3105 PoC El plugin Woody code snippets – Insert Header Footer Code, AdSense Ads para WordPress es vulnerable a Ejecución Remota de Código en todas las versiones hasta, e incluyendo, la 2.5.0 a través del shortcode 'insertphp'. Esto se debe a que el plugin no restringe el uso de la...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

EUVD-2026-94764

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

EUVD-2026-94763

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

GHSA-4PVX-FWJJ-8GPC Ghost: Editors Could Promote Staff Users to Their Own Role

Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. Patches v6.64.0 contains a fix for...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry for WordPress (versions 11.13.12 - 11.17.10 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a failure to validate the destination of redirects when the plugin fetches a user-supplied media URL. This allows users with contributo...

EUVD-2026-94192

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...