CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Injection OGNL vers RCE sur Adobe AEM Forms on JEE 🔎 Vue d'ensemble CVE-2025-54253 est une vulnérabilité critique d'injection OGNL affectant Adobe AEM Forms on JEE. Elle permet à des attaquants non authentifiés d'exécuter des commandes système arbitraires via le point de...

Xenotix-xBOT

Xenotix-xBOT Xenotix xBOT est un bot multiplateforme Linux, Windows, Mac de preuve de concept écrit en Python qui abuse de certains services Google pour implémenter un centre de commande et de contrôle C2 pour le botnet. Les API Google Apps Data, Google Forms et Google Spreadsheet sont utilisées ...

nex-forms_SQL-Injection-CVE-2023-2114

Injection SQL nex-forms CVE-2023-2114 https://vulners.com/cve/CVE-2023-2114 https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d Revue rapide de l'injection SQL dans le plugin NEX-Forms pour WordPress Exploit téléchargé Notez que ce code d'exploit téléchargé n'est pas destiné à...

CVE-2019-10869

CVE-2019-10869 WordPress Extension de téléchargement de fichiers Ninja Forms -----------------------------16345274557837-- Réponse : HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files":...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms: неаутентифицированная произвольная загрузка файлов → RCE A/B Docker-лаборатория, воспроизводящая CVE-2026-32475 CVSS 9.x, Patchstack; поле File Upload в формах Elementor Pro, затронуты версии ≤ 4.2.1, исправлено в 4.2.2 от 2026-08-19; сообщил Tin Pham / TF1T...

CVE-2026-32475

CVE-2026-32475 PoC: Elementor Pro Неаутентифицированная произвольная загрузка файлов с последующим RCE Неаутентифицированная произвольная загрузка файлов в Elementor Pro, приводящая к удалённому выполнению кода Proof-of-concept для CVE-2026-32475 — критической неаутентифицированной произвольной...

CVE-2026-2002-poc

Résumé Le plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder pour WordPress est vulnérable à un Cross-Site Scripting stocké via le paramètre formname dans toutes les versions jusqu’à la 1.50.2 incluse, en raison d’un assainissement insuffisant des entrées et d’un échappeme...

CVE-2026-86834

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

EUVD-2026-91940

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

CVE-2026-86834

The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...

CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

CVE-2023-37979

CVE-2023-37979 Vulnérabilité de Cross-Site Scripting XSS réfléchi non authentifié dans le plugin Saturday Drive Ninja Forms Contact Form versions = 3.6.25. PoC et Checker , à des fins éducatives uniquement 'python3 exploit.py https://target.com'...

CVE-2026-15989

█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗ ██████╗ ██████╗ ████████╗ ██╔══██╗ ████╗ ██║ ╚══██╔══╝ ██║ ██╔══██╗ ██╔═████╗ ██╔═████╗ ╚══██╔══╝ ███████║ ██╔██╗ ██║ ██║ ██║ ██║ ██║ ██║██╔██║ ██║██╔██║ ██║ ██╔══██║ ██║╚██╗██║ ██║ ██║ ██║ ██║ ████╔╝██║ ████╔╝██║ ██║ ██║ ██║ ██║ ╚████║ ██║ ██║ ██████╔╝...

CVE-2026-15989

CVE-2026-15989 — Super Forms ≤ 6.3.316 — PoC повышения привилегий без аутентификации Super Forms – Drag & Drop Form Builder WordPress ≤ 6.3.316 — повышение привилегий без аутентификации через параметр role премиум-дополнения Register & Login. 📋 Обзор уязвимости Атрибут| Детали ---|--- CVE ID|...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

Ninja Forms < 3.6.22 - Cross-Site Scripting

Ninja Forms before 3.6.22 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...