278327 matches found
📄 WordPress Age Gate 3.5.2 Unauthenticated LFI / Remote Code Execution
WordPress Age Gate plugin version 3.5.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already present. This...
📄 WordPress Booking Activities 1.16.43 Authentication Bypass
WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...
📄 WordPress UsersWP 1.2.10 Unauthenticated Blind SQL Injection
WordPress UsersWP plugin version 1.2.10 contains an unauthenticated time-based blind SQL injection vulnerability through ORDER BY. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...
📄 WordPress Atarim Visual Collaboration 4.2.1 Privilege Escalation
WordPress Atarim Visual Collaboration plugin version 4.2.1 contains an authenticated Subscriber+ privilege escalation to advisor vulnerability. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Exploit Title: WordPress Plugin...
📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution
WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...
📄 WordPress Charitable 1.7.0.12 Unauthenticated Privilege Escalation
WordPress Charitable plugin version 1.7.0.12 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the vulnerable request...
📄 WordPress Salon Booking System 9.5 Unauthenticated Shell Upload
WordPress Salon Booking System plugin version 9.5 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow...
📄 WordPress WooCommerce Simple Registration 1.5.6 Unauthenticated Privilege Escalation
WordPress WooCommerce Simple Registration plugin version 1.5.6 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the...
📄 WordPress Simply Schedule Appointments 1.6.9.25 Unauthenticated Blind SQL Injection
WordPress Simply Schedule Appointments plugin version 1.6.9.25 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploi...
fastjson-1.2.83-poc
Fastjson 1.2.84 ，。 Why no need for Gadgets | Hi...
llm-redteam-helixpay
Red-teaming an LLM support agent — HelixPay A self-contained...
wp2shell_sqli_min_poc
This PoC uses widg...
cve-hunter
CVE Hunter v3 — Autonomous Penetration Testing Platform One...
WEB脚本漏洞挖掘机
WEB脚本漏洞挖掘机:自动检测 Web 脚本漏洞，支持 PHP/JS/Python/Java 等 30 种文件类型，内置 46 条审计规则。...
Exploit for CVE-2026-12191
No d...
Wp2Shell
WordPress REST API Desync + SQL Injection Proof-of-concept fo...
Exploit for CVE-2026-63030
CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...
Exploit for CVE-2026-44680
CVE-2026-44680-MikroORM-SQL-Injection-Exploit-Framework PoC to...