CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - Unauthenticated SQL Injection Description The Subscribe to Category plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

cve-2020-7247

cve-2020-7247 Titre de l'exploit : OpenSMTPD 6.6.2 - Exécution de code à distance. Date : 2020-01-29. Auteur de l'exploit : 1F98D. Auteur original : Qualys Security Advisory. Page d'accueil du fournisseur : https://www.opensmtpd.org/. Lien du logiciel :...

CVE-2024-24576-PoC

CVE-2024-24576 PoC The Command::arg and Command::args APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an...

Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia pour WordPress, BuddyPress et bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - Неаутентифицированная SQL-инъекция Описание Плагин Navayan CSV Export для WordPress уязвим к SQL-инъекциям в версиях до 1.0.9 включительно из-за недостаточного экранирования пользовательского параметра и отсутствия надлежащей подготовки существующего...

CVE-2024-55982

CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - Неаутентифицированная SQL-инъекция Описание Плагин Share Buttons – Social Media для WordPress уязвим к SQL-инъекциям в версиях до 1.0.2 включительно из-за недостаточного экранирования пользовательского параметра и отсутствия должной подготовки...

CVE-2024-55978

CVE-2024-55978 Code Generator Pro = 1.2 — SQL-инъекция без аутентификации Описание Плагин Code Generator Pro для WordPress уязвим к SQL-инъекции в версиях до 1.2 включительно из-за недостаточного экранирования пользовательского параметра и отсутствия достаточной подготовки существующего...

CVE-2024-1874

CVE-2024-1874 Концепт-эксплойт для CVE-2024-1874 Внедрение команд через массивоподобный параметр $command функции procopen обход исправления CVE-2024-1874 Суть CVE: В версиях PHP 8.1. до 8.1.29, 8.2. до 8.2.20, 8.3. до 8.3.8 исправление CVE-2024-1874 не работает, если имя команды содержит...

CVE-2024-2876

CVE-2024-2876 Описание уязвимости: Плагин Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce для WordPress уязвим к SQL-инъекции через функцию ‘run’ класса ‘IGESSubscribersQuery’ во всех версиях вплоть до 5.7.14 включительно из-за...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-73073

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...

CVE-2026-19859 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...

CVE-2026-15101

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

PT-2026-83256

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

CVE-2026-78468

CVE-2026-78468 is a reservation duplicate of CVE-2026-78270 . Per connected documents, the underlying vulnerability affects the FluentCRM Pro WordPress plugin in all versions up to and including 3.1.12 . The root cause is SQL Injection due to insufficient escaping on user-supplied parameters and ...

CVE-2026-78468

...

EUVD-2026-65579

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...