auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse는 C으로 작성된 .NET 애플리케이션으로, 그룹 정책 개체GPO에 대한 사용자의 편집 권한을 이용하여 해당 GPO에 의해 제어되는 개체를 손상시키는 데 사용할 수 있습니다. 자세한 내용은 다음 블로그 게시물에서 확인할 수 있습니다: https://labs.mwrinfosecurity.com/tools/sharpgpoabuse 컴파일 지침 필요한 NuGet 패키지가 제대로 설치되어 있는지 확인하고 Visual Studio에서 프로젝트를 빌드하기만 하면 됩니다. 사용법 사용법:...

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

WordPress < 4.8.2 - Authenticated Open Redirect

WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

CVE-2021-38603

CVE-2021-38603 각 사용자의 프로필 편집 페이지에 있는 정보Information: 필드에 저장형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. http:///core/admin/profil.php 취약한 필드: 정보Information: XSS가 삽입되면 해당 사용자가 작성한 모든 페이지/게시글을 방문할 때 트리거될 수 있습니다...

CVE-2022-43980

CVE-2022-43980 PandoraFMS 익스플로잇 제목: 저장형 크로스 사이트 스크립팅 날짜: 2023-02-15 익스플로잇 작성자: Gaurish Kauthankar 공급업체 홈페이지: https://pandorafms.com/en/ 소프트웨어 링크: https://github.com/pandorafms/pandorafms 버전: 테스트 환경: Ubuntu CVE ID: CVE-2022-43980 재현 단계 1. 낮은 권한의 사용자로, 이름에 XSS 페이로드를 포함한 네트워크 맵을 생성합니다. 2. 생성 후, 관리자...

CVE-2025-29602

CVE-2025-29602 - FlatPress CMS 1.3.1의 저장형 크로스 사이트 스크립팅XSS 취약점 설명 Flatpress CMS 1.3.1의 관리 패널에 저장형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. 관리자 권한을 가진 공격자는 악성 JavaScript 페이로드를 시스템에 주입할 수 있으며, 이는 영구적으로 저장됩니다. 일반 사용자가 손상된 페이지예: 블로그 게시물를 방문하면 주입된 페이로드가 피해자의 브라우저에서 자동으로 실행됩니다. 영향을 받는 제품 Flatpress 버전 : 1.3.1 구성 요소 :...

CVE-2025-22710

CVE-2025-22710 1️⃣ Component type WordPress 플러그인 2️⃣ Component details 구성 요소 이름 WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager 취약한 버전 ⚠️ true/false 조건에 따른 응답 값의 차이를 확인하려면 게시물이 최소 1개 이상 존재해야 합니다. 1. Smart Manager 플러그인이 설치된 WordPress 사이트를 준비하고, 관리자...

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause GTIDSUBSET Payload: action=enwdeditwarehouse&editid=1 AND GTIDSUBSETCONCAT0x7170787171,SELECT ELT3874=3874,1,0x717a627171,3874&wpnonce=13db5f2e7d...

EUVD-2026-91963

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928 Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91906

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

CVE-2023-48084-Revised

CVE-2023-48084 — 更新版PoC リポジトリ: MettHK/CVE-2023-48084-Revised Hamibubu/CVE-2023-48084 の更新版で、 マルチスレッド、二分探索による抽出、データベース/テーブル/カラム選択用のCLIフラグを備えています。 元のリポジトリではありません。 これは派生的・改良版のPoCです。元の作業の功績は Hamibubu に帰属します。 免責事項 許可されたセキュリティテストおよび教育目的のみ...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

EUVD-2026-91465

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...