EUVD-2026-54880

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-54894

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

EUVD-2026-54895

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

PT-2026-69271

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.79 Description An issue exists where the plugin fails to validate column names accepted during an unauthenticated AJAX action. Because the nonce guarding this action does not cover the column names,...

PT-2026-69284

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description A remote SQL injection exists in the /admin/AdminLogin.php endpoint. This issue occurs when the email and password variables are manipulated, allowing an attacker to execute...

Elasticsearch BIND Session

BIND payload for listeners/database/elasticsearch !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Elasticsearch BIND Session", "description": "BIND payload for...

PlanetScale Branch Enumeration

Uses leaked PlanetScale service tokens pscaletkn and connection URLs to list organizations, databases, and branches via the PlanetScale API. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PlanetScale organizations, databases, and branches.""" from kittysploit import from...

Redis BIND Session

BIND payload for listeners/database/redis !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Redis BIND Session", "description": "BIND payload for listeners/database/redis", "category":...

MySQL BIND session launcher

Connect the framework MySQL BIND listener with supplied or session-stored credentials and register an interactive MySQL session. !/usr/bin/env python3 -- coding: utf-8 -- """ Open a MySQL BIND framework session using known credentials. Chains after auxiliary/scanner/mysql/mysqlloginbruteforce or...

Neon Database URL Validation

Parses leaked Neon postgres:// URLs .neon.tech and validates Neon Management API keys against /api/v2/projects. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Validate leaked Neon database URLs and Management API keys.""" from kittysploit import from...

MongoDB BIND Session

BIND payload for listeners/database/mongodb !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MongoDB BIND Session", "description": "BIND payload for listeners/database/mongodb", "category":...

MSSQL BIND Session

BIND payload for listeners/database/mssql !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MSSQL BIND Session", "description": "BIND payload for listeners/database/mssql", "category":...

Railway / Render / Fly.io Production Secrets Detection

Classifies Railway, Render, and Fly.io deploy contexts and flags production-grade API keys, database URLs, and Supabase servicerole tokens in client bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect production secrets on Railway, Render, and Fly.io deployments. Complements...

LDAP BIND Session

BIND payload for listeners/database/ldap !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "LDAP BIND Session", "description": "BIND payload for listeners/database/ldap", "category":...

Drizzle / Prisma Schema Exposure Detection

Probes for exposed prisma/schema.prisma, migration SQL, drizzle.config.ts, drizzle/meta/journal.json, and db/schema.ts files leaking full DB schemas. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Drizzle ORM and Prisma schema/migration artifacts.""" from kittysploit import from...

Ghostlink_lite

GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...

EUVD-2026-54738

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Security Bulletin: IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (CVE-2026-18096)

Summary IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak. Vulnerability Details CVEID:CVE-2026-18096 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to cause a denial of service due to a memory leak...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVE-2026-10543)

Summary IBM® Db2® is vulnerable to privilege escalation with a specially crafted query. Vulnerability Details CVEID:CVE-2026-10543 DESCRIPTION: IBM Db2 is vulnerable to privilege escalation with a specially crafted query. CWE:CWE-285: Improper Authorization CVSS Source: IBM CVSS Base score: 8.2...