31007 matches found
EUVD-2026-89885
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
CVE-2026-96833 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...
moodle-login-csrf
This repository contains the files used in finding and exploiting two moodle bugs, MSA-18-0020 CVE-2018-16854 and MSA-19-0004 CVE-2019-3847, which leverage the ability for users to add JavaScript to their own dashboards. MSA-18-0020 relies on CSRF on the login form, whereas MSA-19-0004 requires a...
React-site-CVE-2025-55182
React Site - CVE-2025-55182 README: Vulnerable Next.js project React RSC landing page This repository contains an example of a multi-page corporate landing page built with Next.js 15.0.0 + React 19.0.0. The site mimics a structure similar to t1.ru: home, products, cases, media, about, contacts. W...
CVE-2024-21378
🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🛡️ CVE-2024-21378...
X-Recon
A utility for identifying web page inputs and conducting XSS scanning. Features: Subdomain Discovery: Retrieves relevant subdomains for the target website and consolidates them into a whitelist. These subdomains can be utilized during the scraping process. Site-wide Link Discovery: Collects all...
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin CF7 Views Complete Entry Management for Contact Form 7 versions = 3.2.5...
CSRFER
CSRFER / / | \ | | \ | / /\ --.| |/ / | | | | |/ / | | --. \ /| | | || / | /// / |\ | | | || |\ \ //| \| /| | -.--. " '-, ',' 2 \ \q \ . \ .--' '----. / . . \ .'.' \ .-.\ '-, ,/ .---;- . \ \ .\ // '-. \ \ | '. , '-. c=' Cooo -. '-. '. '-. \ snd '-. '. '-. \ ---' CSRFER is a tool to...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
CVE-2026-93460
A Stored Cross-site scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of appended strings in email form fields. If exploited, an attacker can execute arbitrary scripts within a user's web browser. To remediate this issue, users should update the software to the latest ...
CVE-2026-93460
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
EUVD-2026-89662
Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...
CVE-2026-75823
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
EUVD-2026-89639
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...
fuxploider
fuxploider Fuxploider es una herramienta de pruebas de penetración de código abierto que automatiza el proceso de detección y explotación de vulnerabilidades en formularios de carga de archivos. Esta herramienta es capaz de detectar los tipos de archivo permitidos para subir y es capaz de detecta...
WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...
Contact Form Entries < 1.2.4 - Cross-Site Scripting
The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...
WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting
Competition Form WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to visit a...
WordPress Candidate Application Form <= 1.3 - Local File Inclusion
WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. id: CVE-2015-1000005 info: name: WordPress Candidate Application Form = 1.3 - Local File Inclusion author: dhiyaneshDK severity: high...
Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...