CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

CVE-2025-1338

CVE-2025-1338 This repository contains a proof-of-concept exploit script for CVE-2025-1338 1.Introduction to NUUO-Camera NUUO camera is a network video recorder NVR produced by NUUO Company in Taiwan Province, China. It is widely used in many fields such as retail, transportation, education,...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-85169

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-97241

Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...

NUUO Camera - Unauthenticated OS Command Injection (CVE-2025-1338)

NUUO camera firmware up to 20250203 is vulnerable to unauthenticated OS command injection via the log parameter of /handleconfig.php. Command output is returned in the HTTP response. Opens an execute session for interactive command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO came...

Netsweeper 4.0.8 - Directory Traversal Detection

A directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action. !/usr/bin/env python3 -- coding: utf-8 --...

EUVD-2021-34833

Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col...

CVE-2025-50666

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /webpost.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in parameters such as name, en, userid, log, and time...

EUVD-2025-209345

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /urlrule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time, act, rpri, and log...

CVE-2025-50666

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /webpost.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in parameters such as name, en, userid, log, and time...

CVE-2025-50671

A stack-based buffer overflow vulnerability exists in the D-Link DI-8003 wireless router (firmware version 16.07.26A1 ) due to incorrect bounds checking of parameters in the /xwgl_ref.asp endpoint. A remote attacker can exploit this by sending a crafted HTTP GET request containing excessively lon...

CVE-2026-5148

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

PT-2026-24999

🚨 CVE-2019-25539 202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log user parameter. Attackers can send POST requests to index.php with crafted SQL payloads using time-based blind...

Azure Linux 3.0 Security Update: ansible (CVE-2024-8775)

The version of ansible installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8775 advisory. - A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in...

CVE-2025-14301 Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the processtablebulkactions function processing user-supplied file paths without authentication checks, nonce verification, or path validation...

CVE-2025-14301 Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the processtablebulkactions function processing user-supplied file paths without authentication checks, nonce verification, or path validation...

WordPress Plugin Integration: Opvius AI for WooCommerce – Path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A path traversal...