CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database 150,000+ Verified Exploits & PoCs for Cybersecurity Research All In One Place Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 About SecureWithUmer/Exploit-Index is the world's premier, zero-API aggregat...

WordPress Visual Form Builder <3.0.8 - Information Disclosure

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. id: CVE-2022-0140 info: name:...

Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE

The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the doimageupload AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

CVE-2026-5118

⚡ CVE-2026-5118 Divi Form Builder — 未认证权限提升 "安全研究" • "防御性检测" • "漏洞研究" --- 🔥 概述 CVE-2026-5118 是一个未认证权限提升漏洞，影响 Divi Form Builder 5.1.2 及之前版本。 该问题涉及对用户可控注册参数的验证不足，允许注册数据影响所请求的 WordPress 用户角色。 本仓库包含用于授权安全测试的研究和防御性检测工具。 📌 漏洞信息 属性| 详情 CVE| "CVE-2026-5118" 产品| Divi Form Builder 受影响| "= 5.1.3 ──► 已修复...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857

The Payload headless content management system is vulnerable to Remote Code Execution (RCE) via the @payloadcms/plugin-form-builder component. An attacker can exploit this by crafting a malicious form submission to execute code remotely on the server. This issue is linked to CWE-94 (Code Injectio...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

EUVD-2026-93501

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-5118

Divi Form Builder ⚠️ 警告：此工具仅供授权渗透测试和安全研究使用。 未经授权访问计算机系统是违法的。仅可在您拥有或已获得明确书面许可的系统上使用。 更多免责声明：您可以在 Jenderal92 的封面上查看。请点击此处 !!! 概述 此 Python 2 脚本利用了 Divi WordPress 插件 （及相关 Divi 表单）中的权限提升漏洞。它可以通过以下方式远程注册一个管理员 账户： 从目标的 Divi 注册表单中提取 fbnonce。 向 /wp-admin/admin-ajax.php 发送带有 role=administrator 的精心构造的...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 未认证权限提升（通过角色注入） === Beelze 零日漏洞 1diot9 === 📋 漏洞信息 字段| 详情 ---|--- CVE ID| CVE-2026-5118 CVSS 评分| 9.8 严重 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 — 不恰当的权限管理 插件| Divi Form Builder 由 Divi Engine 开发 受影响版本| 所有版本 ≤ 5.1.2 已修复版本| 5.1.3...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 一个隐藏字段。一个被篡改的值。获得整个网站的完全访问权限。 🧨 攻击者能做什么？ 能力| 影响 ---|--- 🔑 无需登录创建管理员账户| 整站接管 📦 访问 WooCommerce 客户数据| 数据泄露 💉 编辑插件/主题文件（PHP）| 远程代码执行 🕳️ 创建隐藏后门| 持久化访问 👥 查看所有用户数据| 侵犯隐私 🔬 漏洞分析 漏洞位置 includes/shared/handlers/FormSubmissionHandler.php → createuser 漏洞代码 // Baris 1691: Ambil...

CVE-2026-5118

CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder 未授权 RCE 针对 CVE-2026-5524 的大规模利用工具包，该漏洞是 WordPress 插件 Divi Form Builder = 5.1.8 中的未授权任意文件上传漏洞，可导致远程代码执行。 字段| 值 ---|--- CVE| 2026-5524 CVSS| 9.8 严重 向量| AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 受影响版本| Divi Form Builder = 5.1.8 已修复版本| 5.1.9 类型| 未授权文件上传导致 RCE 研究者| 0xd4rk5i...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

EUVD-2026-91915

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...