CVE-2026-120688

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.25.25 . The root cause is insufficient input sanitization and output escaping when the plugin processes SQL reports that select attacker-...

CVE-2026-120688 EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT demonstrated; more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to...

CVE-2026-115548

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-115548

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.1.0.48 . The root cause is insufficient input sanitization and output escaping regarding the HTTP_USER_AGENT parameter. This flaw allows unauthent...

CVE-2026-115548 Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-119164

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2001-1437

Malware in sbrugna...

EUVD-2007-4523

Malware in sbrugna...

EUVD-2012-4207

Malware in sbrugna...

EUVD-2005-4025

Malware in sbrugna...

Apache Mod_cgi Bash Environment Variable Injection (Shellshock) Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache modcgi Bash Environment Variable Injection Shellshock Scanner', 'Description' = %q This module scans for the Shellshock vulnerability, a...

CVE-2024-1762 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTPUSERAGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-1762 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTPUSERAGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2024-1762

CVE-2024-1762 affects NextScripts: Social Networks Auto-Poster for WordPress. The vulnerability is Stored XSS in HTTP_USER_AGENT present in all versions up to 4.4.3 due to insufficient sanitization/escaping. Exploitation requires the victim to view the page with the cron events list (“All Cron Ev...

CVE-2024-1762: Improper Neutralization of Input During Web Page Generation

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTPUSERAGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2021-4252: Improper Neutralization

A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function togglecheckbox of the file ban-options.php. The manipulation of the argument $SERVER"HTTPUSERAGENT" leads to cross site scripting. The attack may be initiated remotely. The name of the...

CVE-2021-4252

CVE-2021-4252 affects the WordPress WP-Ban plugin, specifically the function toggle_checkbox in ban-options.php. The issue arises from manipulating the request header value $_SERVER["HTTP_USER_AGENT"], enabling cross-site scripting. The vulnerability can potentially be initiated remotely. A patch...

GHSA-Q6V4-XJP2-8GGV Securimage HTML Injection

HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

Securimage HTML Injection

HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

UADMIN Botnet 1.0 - 'link' SQL Injection

Exploit Title: UADMIN Botnet 1.0 - 'link' SQL Injection Google Dork: n/a Date: 2020-03-16 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Version: unkn0wn Tested on: Windows 10, Kali CVE : n/a Vuln-Code: download.php $link=$GET'link'; $agent=esc$SERVER'HTTPUSERAGENT';...