INPGer

INPGer | CVE-2022-4063 - Galería InPost Herramienta automática masiva para verificar la vulnerabilidad CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...

CVE-2025-44108-SXSS

CVE-2025-44108 - Vulnerabilidades de Cross-Site Scripting XSS almacenado en FlatPress CMS 1.3.1 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en el panel de administración de Flatpress CMS 1.3.1. Un atacante con privilegios de administrador puede inyectar una carga...

ThingsBoard-IoT-Platform-CVE-2024-55466

Escalada de privilegios en ThingsBoard mediante XSS almacenado Mientras experimentaba con tecnología IoT, encontré una vulnerabilidad en la aplicación Thingsboard que permitía vías para la escalada de privilegios. Thingsboard es una aplicación de código abierto que permite la gestión de...

CVE-2019-11932

CVE-2019-11932 La dirección de system y el gadget deben reemplazarse por la dirección real encontrada mediante una vulnerabilidad de divulgación de información. Después de reemplazar la dirección de system y el gadget, ejecute el código para generar el archivo GIF corrupto: root@kitploit:...

UPGer

UPGer | CVE-2022-4060 - User Post Gallery Herramienta automática masiva para verificar la vulnerabilidad en CVE-2022-4060 - Plugin de WordPress: User Post Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh...

CVE-2019-11932

CVE-2019-11932 La dirección de system y el gadget deben ser reemplazadas por la dirección real encontrada mediante una vulnerabilidad de divulgación de información. Después de reemplazar la dirección de system y el gadget. Ejecute el código para generar el archivo GIF corrupto: root@kitploit:...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...

windbg_js_scripts

WinDbg JavaScript Scripts Install as a WinDbg gallery Clone the repository root@kitploit: git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, edit the lines Setting Name="LocalCacheRootFolder" to reflect the local path of the repository. In WinDbg, load the config.xm...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Inyección SQL ciega no autenticada Descripción Se descubrió una vulnerabilidad de Inyección SQL ciega Blind SQL Injection en el plugin WordPress Contest Gallery versiones 28.1.4 y anteriores. El problema ocurre debido al uso inseguro del parámetr...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

CVE-2015-4133

CVE-2015-4133 root@kitploit: usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery plugin de WordPress = 3.1.3 CVE-2015-4133 PoC. Referencia: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 argumentos posicionales: YEAR subdirectorio de wp-content/uploads MONTH...

CVE-2019-11932-whatsApp-exploit

CVE-2019-11932-whatsap-exploit The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: now lets do it...

CVE-2026-89244

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

CVE-2026-89244

WWBN AVideo through commit c3edcc27 contains a reflected XSS in plugin/Gallery/view/Category.php when the SubCategories feature is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing an attacker to inject a script that executes in a visitor's browser...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

EUVD-2026-76056

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

ScubaGear

ScubaGear is an assessment tool that verifies that a Microsoft 365 M365 tenant’s configuration conforms to the policies described in the Secure Cloud Business Applications SCuBA Secure Configuration Baseline documents. !NOTE This documentation can be read using GitHub Pages. Target Audience...

Gallery-Plugin-SQL-Injection

Título del exploit: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Fecha: 2024-07-05 Autor del exploit: tmrswrr Categoría: Webapps Página del proveedor: https://total-soft.com/wp-video-gallery/ Versión 2.3.6 1. Accede al panel de administración: Navega hasta el...

CVE-2024-55981

CVE-2024-55981 Nabz Image Gallery = v1.00 - Unauthenticated SQL Injection Description The Nabz Image Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, v1.00 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...