316247 matches found
EUVD-2026-70665
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...
Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Prototype Pollution (CVE-2025-13465, CVE-2026-2950, CVE-2026-4800)
Summary There are vulnerabilities in lodash-4.17.21.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-13465, CVE-2026-2950, CVE-2026-4800. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are...
SPIPScan
SPIPScan ماسح SPIP نظام إدارة المحتوى لأغراض اختبار الاختراق، مكتوب بلغة Python ومُرخَّص بموجب رخصة MIT. تم تصميم هذه الأداة للكشف عن تثبيتات SPIP أثناء اختبار الاختراق. حاليًا، تكتشف الأداة إصدار تثبيت SPIP وتحاول معرفة ما إذا كانت المنصة تستخدم بعضًا من أفضل 30 إضافة المدرجة على موقعها...
autocrack
AUTOCRACK.py Ce script Python est un wrapper pour Hashcat https://hashcat.net afin d'automatiser le processus de craquage. Le script inclut plusieurs fonctions pour sélectionner un ensemble de listes de mots et de règles, ainsi que la capacité d'exécuter une attaque par force brute, avec des...
c41n
c41n c41n هي أداة إعداد نقطة وصول وهمية آلية. توفر c41n إعدادًا آليًا لعدة أنواع من نقاط الوصول الوهمية وهجمات التوأم الشرير Evil Twin. تقوم c41n بإعداد نقطة وصول بخصائص يحددها المستخدم الواجهة والاسم والقناة لنقطة الوصول، وتقوم بإعداد خادم DHCP لنقطة الوصول، وتوفر للمستخدم إمكانيات التقاط حركة...
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...
GHSA-8J6P-R8JG-MXQH Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62601
Orval: Import-time RCE via header-parameter default - zod module-level template literal...
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Last week, there were 246 vulnerabilities disclosed in 174 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 121 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
CVE-2022-44877
Centos Web Panel 7 تنفيذ كود عن بُعد بدون مصادقة - CVE-2022-44877 root@kitploit: + Centos Web Panel 7 Unauthenticated Remote Code Execution + Centos Web Panel 7 - log ➜ CVE-2022-44877 cat log examplelog ➜ CVE-2022-44877 echo "examplelog $whoami" log ➜ CVE-2022-44877 cat log examplelog examplelog...
Pachine
Pachine Implémentation Python pour CVE-2021-42278 Élévation de privilèges Active Directory. Installation root@kitploit: $ pip3 install impacket Utilisation root@kitploit: Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE...
GHSA-653Q-5476-X79G Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
EUVD-2026-62604
Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli...
NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
CVE-2026-82024
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary...
PyShell
PyShell PyShell एक मल्टीप्लेटफ़ॉर्म Python वेबशैल है। यह उपकरण आपको एक वेब सर्वर पर शेल जैसा इंटरफ़ेस प्राप्त करने में मदद करता है ताकि दूरस्थ रूप से एक्सेस किया जा सके। अन्य वेबशैल के विपरीत, इस उपकरण का मुख्य उद्देश्य सर्वर साइड पर जितना संभव हो उतना कम कोड का उपयोग करना है, चाहे उपयोग की जाने...
