promptmap

root@kitploit: O O o.-. Humans, Do Not Resist! |/ ,-'-. / /, / /|.-.| / --O-- .--""" /\ /\ | o.o / Utku Sen's /|\ -'--' / /| | - | / | | | \ /| | | ' \ '/ \ ' | ' \ | ' / | ' \ | / | | | ./| /||| ./|||,| .// / / |-----| || || || || promptmap2 is a an automated prompt injection scanner for...

Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting

The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

MAL-2026-16367 Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2024-24136

CVE-2024-24136 : 算数ゲーム クロスサイトスクリプティング 概念実証（PoC） : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24136.md 概念実証（PoC） : https://github.com/BurakSevben/CVE-2024-24136/blob/main/CVE-2024-24136.md...

CVE-2026-92749

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

Astra Linux – Vulnerability in Golang-1.15

In Go versions before 1.15.13 and 1.16.x, as well as before 1.16.5, there might be a panic occurring when a large exponent is used in the math/big.RatSetString or Un MarshalText method...

Astra Linux – Vulnerability in pillow

In Pillow’s PIL.ImageMath.eval before version 9.0.0, it was possible to evaluate arbitrary expressions, including those that used the Python exec method. A lambda expression could also be used...

Astra Linux – Vulnerability in pillow

Pillow through 10.1.0 allows for arbitrary code execution via the environment parameter. This is a different vulnerability than CVE-2022-22817, which involved the expression parameter...

Fedora 45 : perl-Dancer2 (2026-28c5da9193)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-28c5da9193 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

SUSE CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability

Author+ Robots and Pillar Content Meta Update on Non-Owned Objects vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77783

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-77784

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77788

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...