CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

CVE-2026-86834

The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...

WordPress MetForm plugin 2.2.1-4.3.0 - Unauthenticated Debug File Disclosure vulnerability

Unauthenticated Debug File Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Metform versions 2.2.1-4.3.0...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Authenticated Arbitrary File Write vulnerability

Authenticated Arbitrary File Write vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

EUVD-2026-91937

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-80517

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate file types within uploaded archives or sanitize their content before storing them in a publicly served location. This allows...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...

EUVD-2026-91935

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

EUVD-2026-91933

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

CVE-2026-103293

The MPG WordPress plugin before version 4.2.3 is vulnerable to an arbitrary file read flaw. The root cause is a failure to validate that a dataset source supplied during project import is a remote URL; instead, the system treats it as a local filesystem path and copies the content into a publicly...

CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab（用于Contact Form 7的拖放多文件上传） 快速搭建一个易受攻击的WordPress环境，以复现并验证CVE-2025-3515——插件drag-and-drop-multiple-file-upload-contact-form-7（≤ 1.3.8.9）中通过ddmuuploadfile实现的无限制文件上传。此实验环境已Docker化，可使用Nuclei快速、确定性地进行测试。 易受攻击的插件：drag-and-drop-multiple-file-upload-contact-form-7 v1.3.8.9...

YARA_Rules

Reglas Yara de MALGAMY Este proyecto contiene una colección de reglas de Yara que se pueden utilizar para identificar y clasificar varios tipos de archivos. Tabla de Contenidos Resumen Instalación Uso Contribuciones Resumen Yara es una herramienta que permite a los usuarios crear sus propias regl...

CanaryHunter

Canary Hunter Resumen Durante la ejecución de múltiples compromisos de red team en los últimos años, me he encontrado en varias ocasiones con Canary Tokens que podrían alertar al SOC de las acciones realizadas. Por ello, dediqué tiempo a investigar a fondo si existían formas de detectar estos...

Volumiser

Volumiser Introducción Volumiser es una herramienta de línea de comandos y una GUI de consola interactiva para listar, explorar y extraer archivos de formatos comunes de imágenes de discos duros de máquinas virtuales. La herramienta fue escrita para combatir un problema habitual: las imágenes de...

Defender_Exclusions-BOF

Exclusiones de Defender BOF Qué Un BOF para determinar las exclusiones de Windows Defender: Extensiones Procesos Carpetas Por qué Ejemplos de uso del compilador C++ para crear BOFs sin necesidad de las desreferencias intermedias de vtable. Compilación cd src make all Uso 1. Cargar...

IATelligence

IATelligence IATelligence es un script de Python que extrae la Tabla de Direcciones de Importación IAT de un archivo PE y utiliza el modelo GPT-3 de OpenAI para proporcionar detalles sobre cada API de Windows importada por el archivo. El script también busca técnicas relacionadas de MITRE ATT&CK ...