149 matches found
fubucker
Fubucker | CVE-2022-1386 - Fusion Builder Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh Install JQ Linux : command apt-get install jq -y Windows : For WSL just d...
CVE-2022-1386-FusionBuilder-SSRF
CVE-2022-1386 – Fusion Builder 示例： root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun 使用Interact.sh或Burp Collaborator接收回调。 📋 示例输出 root@kitploit: 从目标获取nonce... 向https://abc123.oast.fun发送SSRF载荷... + SSRF确认：从受害服务器收到回调。 📌 注意 此PoC不会进行数据窃取。 仅限道德使用：未经授权请勿利用系统。 📚...
WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery
WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...
CVE-2022-1386
Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of Concept Request: root@kitploit: POST /wp-admin/admin-ajax.php...
CVE-2022-1386
CVE-2022-1386 - Fusion Builder 3.6.2 - Unauthenticated SSRF Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface. It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server. Proof of...
CVE-2026-8713
CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...
EUVD-2026-67409
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...
WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability
Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...
CVE-2026-18431
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
EUVD-2026-66293
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...
CVE-2026-18431
The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...
PT-2026-81951
Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 Description An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is...
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...
CVE-2026-12536
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Avada (Fusion) Builder plugin <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Zbigniew Piotrak in WordPress Plugin Fusion Builder versions = 3.15.5...
CVE-2026-56008
Contributor Privilege Escalation in Fusion Builder = 3.15.4 versions...