Exploit for CVE-2026-14894

CVE-2026-14894 Arbitrary File Upload Nxploited Mass Exploi...

CVE-2026-48866

...

VulnCheck KEV: CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-84434

CVE-2026-84434 — Gravity Forms 인증되지 않은 임의 파일 업로드 Gravity Forms 의 CVE-2026-84434에 대한 Python 3 PoC 스캐너 및 익스플로잇입니다. | ---|--- 플러그인| gravityforms 영향받는 버전| ≤ 3.1.0.4 수정된 버전| 3.1.0.5+ 벤더 보안 릴리스 3.1.1 CVSS| 9.8 치명적 인증| 인증 불필요 CWE| CWE-434 — 제한 없는 업로드 공로| 0xd4rk5id3 — EnvoraSec Wordfence 요약 숨겨진 File Uplo...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS This repository reveals a security vulnerability discovered in Motivian Content Management System v.41.0.0. CVE-2025-29094: Multiple Stored Cross-Site Scripting XSS This vulnerability was reported to the vendor in accordance with responsible...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

cve-2026-67363-67364

Balbooa Forms 사전 인증 RCE + 결제 변조 CVE-2026-67364 / CVE-2026-67363 Joomla용 Balbooa Formscombaforms의 두 가지 사전 인증 취약점에 대한 PoC 및 탐지 템플릿으로, 2.4.3.2 에서 수정되었습니다. CVE-2026-67364 — 사전 인증 PHP 코드 삽입 - RCE CVSS 9.8 CVE-2026-67363 — 사전 인증 결제 금액 변조 Stripe / Authorize.net Lulztigre가 발견했으며, Joomla 보안 대응팀JSST을 통한 조정...

CVE-2026-3584

CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - Unauthenticated Remote Code Execution via formprocess 🔥 Vulnerability Summary The WordPress Kali Forms plugin versions = 2.4.9 contain a critical unauthenticated remote code execution RCE vulnerability. This flaw allows unauthenticated attackers to...

CVE-2026-87067

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

EUVD-2026-83670

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067

CVE-2026-87067 affects the Forminator Forms WordPress plugin in versions before 1.57.2.1 . The plugin fails to restrict which classes may be instantiated when it deserialises a value received from an XML-RPC request , enabling a PHP object injection attack. An attacker holding the plugin's forms-...

CVE-2026-87068

Forminator Forms for WordPress (before 1.57.2.1 ) contains an authenticated privilege escalation vulnerability. When a registration form is nested inside an imported quiz, the plugin fails to enforce the role validation it applies elsewhere. This allows a user with quiz-import capability to publi...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

drupal-cve-2018-7600-poc

README Drupal Drupalgeddon 2 Unauthenticated Remote Code Execution CVE-2018-7600 Drupal versions prior to 7.58, 8.x versions prior to 8.3.9, 8.4.x versions prior to 8.4.6, and 8.5.x versions prior to 8.5.1 allow remote attackers to execute arbitrary code due to an issue affecting multiple...

cve-2026-32475-elementor-pro-lab

CVE-2026-32475 — Elementor Pro Forms 인증되지 않은 임의 파일 업로드 → RCE CVE-2026-32475CVSS 9.x, Patchstack, Elementor Pro Forms File Upload 필드, 영향 ≤ 4.2.1, 2026-08-19에 4.2.2에서 수정, Tin Pham / TF1T 보고을 재현하는 A/B Docker 랩입니다. 인증되지 않았으며 사용자 상호작용이 필요 없습니다. 승인된 테스트/교육 전용입니다. 이 랩은 폐기 가능한 Docker 컨테이너에서 전적으로...

CVE-2026-15664

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...