140 matches found
CVE-2025-5287
CVE-2025-5287 PoC Unauthenticated SQL Injection exploit for WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-5287 , targeting a vulnerability in the WordPress Likes and Dislikes Plugin ≤ 1.0.0. The vulnerability allows...
CVE-2025-5287
CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...
twint
TWINT - Twitter Intelligence Tool No authentication. No API. No limits. Twint is an advanced Twitter scraping tool written in Python that allows for scraping Tweets from Twitter profiles without using Twitter's API. Twint utilizes Twitter's search operators to let you scrape Tweets from specific...
CVE-2025-5287
🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...
CVE-2025-4840
CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...
BIT-GHOST-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...
CVE-2026-103288: Authorization Bypass Through User-Controlled Key
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...
PT-2026-103820
Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation flaw exists in the comment like feature. This allows an authenticated member to delete comment likes or dislikes belonging to other users without proper authorization, leading...
CVE-2026-14305 WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
EUVD-2026-24523
WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...
WWBN AVideo 跨站请求伪造漏洞
WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 29.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from multiple AVideo JSON endpoints under the objects/ directory accepting status...
PT-2026-34198
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1 Description Multiple JSON endpoints under 'objects/' accept state-changing requests via $ REQUEST and $ GET without anti-CSRF tokens, origin checks, or referer checks. This allows a malicious page to perform...
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
Summary In objects/like.php, the getLike method constructs a SQL query using a prepared statement placeholder ? for usersid but directly concatenates $this-videosid into the query string without parameterization. An attacker who can control the videosid value via a crafted request can inject...
EUVD-2026-11089
The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wpulikelikersbox shortcode template attribute in all versions up to, and including, 5.0.1. This is due to the use of htmlentitydecode on shortcode attributes without subsequent output sanitization, which...
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
WordPress Likes and Dislikes Plugin plugin <= 1.0.0 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Likes and Dislikes versions = 1.0.0...
EUVD-2016-1705
Malware in sbrugna...
EUVD-2018-10273
Malware in sbrugna...