EUVD-2026-91940

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

CVE-2026-86834

The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...

WordPress MetForm plugin 2.2.1-4.3.0 - Unauthenticated Debug File Disclosure vulnerability

Unauthenticated Debug File Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Metform versions 2.2.1-4.3.0...

CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

EUVD-2026-91937

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Authenticated Arbitrary File Write vulnerability

Authenticated Arbitrary File Write vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-80517

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate file types within uploaded archives or sanitize their content before storing them in a publicly served location. This allows...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...

EUVD-2026-91935

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

CVE-2026-103293

The MPG WordPress plugin before version 4.2.3 is vulnerable to an arbitrary file read flaw. The root cause is a failure to validate that a dataset source supplied during project import is a remote URL; instead, the system treats it as a local filesystem path and copies the content into a publicly...

EUVD-2026-91933

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

CVE-2026-103293 MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role an...

lab-cve-2025-3515

مختبر WordPress لـ CVE-2025-3515 Drag and Drop Multiple File Upload for Contact Form 7 قم بتشغيل بيئة WordPress ضعيفة لإعادة إنتاج CVE-2025-3515 والتحقق منها — رفع ملفات غير مقيد عبر ddmuuploadfile في الإضافة drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8.9. هذا المختبر مُعدّ بصيغة...

YARA_Rules

قواعد Yara من MALGAMY يحتوي هذا المشروع على مجموعة من قواعد Yara التي يمكن استخدامها لتحديد وتصنيف أنواع مختلفة من الملفات. جدول المحتويات نظرة عامة التثبيت الاستخدام المساهمة نظرة عامة Yara هي أداة تتيح للمستخدمين إنشاء قواعدهم الخاصة لتحديد وتصنيف الملفات بناءً على خصائصها. يمكن استخدام هذه...

CanaryHunter

Canary Hunter الملخص خلال تنفيذ عدة مهام للفريق الأحمر Red Team على مدى السنوات القليلة الماضية، واجهت في أكثر من مناسبة Canary Tokens قد تنبّه مركز العمليات الأمنية SOC إلى الإجراءات المتخذة. لذلك أمضيت بعض الوقت في الغوص في هذا الموضوع لاكتشاف ما إذا كانت هناك طرق لكشف هذه الـ Canary داخل الملف...

Volumiser

Volumiser مقدمة Volumiser هي أداة سطر أوامر وواجهة رسومية تفاعلية في وحدة التحكم، تُستخدم لسرد وتصفح واستخراج الملفات من تنسيقات صور الأقراص الثابتة الافتراضية الشائعة. كُتبت الأداة لمعالجة مشكلة متكررة؛ إذ غالباً ما يصعب التعامل مع صور الأقراص الضخمة التي تزيد عن 100 جيجابايت أو استخراجها عند...

Defender_Exclusions-BOF

BOF لاستثناءات Defender ما هو؟ ملف BOF لتحديد استثناءات Windows Defender: الامتدادات العمليات المجلدات لماذا؟ أمثلة على استخدام مترجم C++ لإنشاء ملفات BOF دون الحاجة إلى عمليات إلغاء الإشارة عبر vtable الوسيطة. البناء cd src make all الاستخدام 1. حمّل dist/cEnumerateDefender.cna 2. شغّل في Beacon...