birp

Big Iron Recon & Pwnage BIRP автор @singe Dominic White @ SensePost Обзор BIRP — это инструмент, который помогает при оценке безопасности мейнфреймовых приложений, работающих через TN3270. Подобно тому, как BURP и другие прокси для веб-приложений помогают в тестировании веб-приложений, BIRP нацел...

CVE-2023-31584

CVE-2023-31584 - Уязвимость межсайтового скриптинга XSS в cu/silicon Github ссылка: https://github.com/cu/silicon Затрагиваемая версия: 1 Серьёзность и CVSS: Будет обновлено после проверки NIST. Тип: Межсайтовый скриптинг XSS Корневая причина: Отсутствие должной проверки и очистки ввода перед...

CVE-2022-24086

CVE-2022-24086 Проверено на: magento 2.4.3 с демонстрационными данными Docker-образ: docker.io/bitnami/magento:2.4.3-debian-10-r0 Имя: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

CVE-2023-51800

CVE-2023-51800 School Fees Management System v1.0 - Множественные уязвимости межсайтового скриптинга XSS Описание : Множественные уязвимости межсайтового скриптинга XSS в School Fees Management System v1.0. Версия уязвимого продукта : School Fees Management System v1.0 Автор CVE : Geraldo Alcânta...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.5...

CVE-2021-43032

CVE-2021-43032 XenForo ≤ 2.2.7에서, 관리자 패널에 접근 권한이 있는 위협 행위자는 HTML 코드를 허용하는 애플리케이션 내 모든 기능에 XSS교차 사이트 스크립팅 페이로드를 저장할 수 있습니다. 'Advertising' 기능 내에 배치된 페이로드는 클라이언트 측에서 전역적으로 실행되어 여러 악용 시나리오를 가능하게 하는 반면, 다른 페이로드는 저장된 위치에 따라 클라이언트 측에서 실행됩니다. 크레딧: John Jackson @johnjhacking & Jackson Henry @JacksonHHax 재...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909 Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

EUVD-2026-91915

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

trappsec

trappsec trappsec — это фреймворк с открытым исходным кодом, который помогает разработчикам выявлять атакующих, исследующих бизнес-логику API. Встраивая реалистичные маршруты-приманки и поля-ловушки, которые сложно отличить от реальных конструкций API, злоумышленники подталкиваются к...

CVE-2026-95865

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-95865

The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 2.11.0.5 . The root cause is insufficient escaping of the fields[][value] parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...

CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

EUVD-2026-91875

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

Discourse - Private User Field Disclosure via Directory Items IDOR

Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on userfieldids parameter in DirectoryItemsControllerindex, letting any user retrieve private user field values, exploit requires no authentication. id: CVE-2026-26265 info:...

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

VidShop for WooCommerce <= 1.1.4 - SQL Injection

VidShop – Shoppable Videos for WooCommerce plugin for WordPress = 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-0702 info: name: VidShop for WooCommerce =...

WordPress IWS Geo Form Fields <=1.0 - SQL Injection

WordPress IWS Geo Form Fields plugin through 1.0 contains a SQL injection vulnerability. The plugin does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data,...

WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server. id: CVE-2022-4328 info: name: WooCommerce Checkout Field Manager 18.0 - Arbitrary File Uploa...