1101 matches found
CVE-2026-PoCs
CVE-2026-PoCs Una colección verificada y seleccionada por la comunidad de exploits de prueba de concepto para CVEs divulgados en 2026. Por qué este repositorio La mayoría de las colecciones de PoCs de CVE están dispersas en hilos de Twitter, gists y enlaces de blogs muertos. Este repositorio...
CVE-2026-5118
🔥 CVE-2026-5118 Divi Form Builder Un campo oculto. Un valor modificado. Acceso completo a todo el sitio web. 🧨 ¿Qué puede hacer el atacante? 🔬 Análisis de Vulnerabilidad Ubicación de la Vulnerabilidad root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Código Vulnerable...
CVE-2026-5118
CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...
CVE-2026-79701 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0
Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...
WordPress Visual Form Builder <3.0.8 - Information Disclosure
WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...
CVE-2026-5524-PoC
CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...
CVE-2026-5118
CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...
CVE-2026-5118
Divi Form Builder ⚠️ WARNING: This tool is for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test. More Disclaimer You can see the disclaimer on the cover of...
CVE-2026-5118
CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 ロールインジェクションによる認証なしの権限昇格 === Beelze zeroday 1diot9 === 📋 脆弱性情報 フィールド| 詳細 ---|--- CVE ID| CVE-2026-5118 CVSS スコア| 9.8 Critical CVSS ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 — Improper Privilege Management プラグイン| Divi Form Builder by...
CVE-2026-14558
CVE-2026-14558 affects the WP User Frontend WordPress plugin prior to 4.3.10 . The flaw lies in the AI Form Builder component, which does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts. Users with Editor-level access (or ...
CVE-2026-17123
The CVE describe a Server-Side Request Forgery in the Royal Elementor Addons WordPress plugin (versions ≤ 1.7.1064). The Form Builder widget’s webhook_url setting persists attacker-controlled URLs into wpr_webhook_url_{widget_id} on each render. The wpr_form_builder_webhook AJAX handler, usable b...
CVE-2026-17123 Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...
EUVD-2026-59863
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...
EUVD-2026-53880
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...
CVE-2026-66425
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...
CVE-2026-66425
Technical details are not publicly available in the provided documents. Monitor for updates from the listed sources.
CVE-2026-15052
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15052
Affected software: MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress (versions ≤ 4.3.3). Vulnerability type & root cause: Stored Cross‑Site Scripting due to insufficient input sanitization and output escaping in form field handling. Impact: Unauthenticated ...
CVE-2026-59517
CVE-2026-59517 concerns the WordPress plugin Easy Form Builder (versions <= 4.0.12). The supplied documents confirm an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting this plugin, with the affected component/version explicitly stated as Easy Form Builder