CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Controlli di accesso impropri nelle chiamate AJAX Subscriber+ Descrizione: Alcune chiamate AJAX del plugin non verificano correttamente le capacità e i token CSRF, portando a problemi come lettura arbitraria di post, esportazione della lista ...

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

The CERT Coordination Center CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912 , both stem...

Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks.

Simulazione e prevenzione degli attacchi di vulnerabilità Zerologon CVE-2020-1472. Simulazione dell'attacco di vulnerabilità Zerologon CVE-2020-1472 in Active Directory su Windows Server 2016 e dell'uso della soluzione Trend Micro Deep Security per prevenire tali attacchi. La vulnerabilità...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 4.9.8...

CVE-2023-1454-EXP

CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Vulnerabilità di SQL injection non autorizzata JeecgBoot è una piattaforma di sviluppo low-code basata su un generatore di codice. Utilizzata per applicazioni Web aziendali, la piattaforma Java low-code jeecg-bootv3.5.0 presenta la più recente SQL...

CVE-2025-30911

Exploit per CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 Questo script sfrutta una vulnerabilità critica nel plugin WordPress RomethemeKit For Elementor = v1.5.4 che consente l'installazione e l'attivazione arbitraria di plugin da parte di utenti autenticati , potenzialmente portando...

CVE-2025-28915

CVE-2025-28915 - Exploit per Arbitrary File Upload in WordPress ThemeEgg ToolKit 📌 Descrizione Una vulnerabilità di Unrestricted File Upload nel plugin ThemeEgg ToolKit per WordPress versioni ≤ 1.2.9 consente a attaccanti autenticati di caricare web shell sul server. Ciò può portare a esecuzione...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload Exploit FileOrganizer - CVE-2024-7985 📌 Panoramica CVE-2024-7985 - Il plugin WordPress FileOrganizer = 1.0.9 è vulnerabile a upload arbitrari di file autenticati , consentendo ad attaccanti con privilegi...

CVE-2025-25101

🚀 CVE-2025-25101 - WordPress Munk Sites Plugin = 1.0.7 - CSRF zur beliebigen Plugin-Installation 📌 Übersicht CVE-2025-25101 ist eine Cross-Site-Request-Forgery CSRF -Sicherheitslücke im MetricThemes Munk Sites -Plugin für WordPress Versionen ≤ 1.0.7. Diese Sicherheitslücke ermöglicht es einem nic...

CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Upload Arbitrario di File Autenticato Contributor+ Utilizzo root@kitploit: usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY...

CVE-2024-50492

🚨 CVE-2024-50492 - ScottCart 🔥 Exploit-Skript für ScottCart 🧑‍💻 Von Nxploit – Khaled Alenazi 📌 Beschreibung Das ScottCart -Plugin für WordPress Versionen ≤ 1.1 ist anfällig für Remote Code Execution RCE. Dadurch können nicht authentifizierte Angreifer über einen verwundbaren AJAX-Endpunkt beliebige...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint = 1.3.1 plugin per WordPress Arbitrary File Upload Descrizione Il plugin Post Saint per WordPress versioni fino alla 1.3.1 inclusa è vulnerabile al caricamento arbitrario di file a causa della mancanza di controlli delle capacità e della validazione del tipo di file...

Chakra-CVE-2019-0567

Chakra-CVE-2019-0567 Ein POC eines Type-Confusion-Bugs im chakracore-Framework, der zur Codeausführung führt. Basierend auf Connor McGars Blog https://connormcgarr.github.io/ HINWEIS: Die Offsets und ROP-Gadgets hängen von der verwendeten Windows-Version ab, daher könnte es bei dir nicht...

CVE-2026-15985 Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

EUVD-2026-66410

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-15985

The Classified Listing – Mobile Number Verification WordPress plugin is vulnerable to unauthenticated authentication bypass in all versions up to and including 1.6.0 . The root cause is missing server-side Firebase OTP validation in the process_otp_login() function, allowing an attacker to authen...

CVE-2024-3400-Compromise-Checker

Verificador de Comprometimento CVE-2024-3400 Um script bash muito simples para verificar evidências de comprometimento relacionadas à CVE-2024-3400 em firewalls Palo Alto. Projetado para fornecer uma triagem inicial rápida de dispositivos potencialmente impactados por meio da verificação da...

CVE-2022-42864

CVE-2022-42864: Diabolische Cookies Was ist dieses Repo? Dies ist mein unvollständiger Proof-of-Concept-Exploit für CVE-2022-42864, eine Time-of-Check-Time-of-Use-Schwachstelle in IOHIDFamily, die mit iOS 16.2 / macOS Ventura 13.1 behoben wurde. Wie ist der Status des Proof-of-Concept? Der Exploi...

Atlassian_CVE-2022-26134

Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 Am 30. Mai 2022 identifizierte eine Organisation namens Volexity eine nicht authentifizierte RCE-Schwachstelle Bewertung 9.8 bei NIST in Atlassians Confluence Server und Data Center Editionen...