Lucene search
+L

1120 matches found

Kitploit
Kitploit
added 2026/09/16 7:21 a.m.8 views

CVE-2022-32114

Strapi v4.1.12 Vulnerability Explanation: An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file Attack Vectors: After uploading a file containing malicious content, when the user opens the link to t...

8.8CVSS8.3AI score0.01999EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/16 2:04 a.m.34 views

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

8.5CVSS6.2AI score0.01668EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/16 2:04 a.m.36 views

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

7.5CVSS7.3AI score0.04864EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/09/15 1:14 p.m.9 views

blind-xxe-controller-CVE-2021-29447

Blind XXE controller I make this controller on doing metatwo machine in HackTheBox to exploiting CVE-2021-29447 which Is a WordPress XXE Vulnerability in Media Library affected version 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. where an authenticated user with ability to upload media library can upload...

7.1CVSS7AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/15 7:42 a.m.13 views

CVE-2021-29447

CVE-2021-29447 POC to exploit WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. More about this CVE here Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress website with Media Library vulnerable to XXE Injection. root@kitploit: python lfi.py -u manager -p...

7.1CVSS7.1AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/14 2:17 p.m.7 views

CVE-2021-29447-PoC

CVE-2021-29447 Proof-of-Concept root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ Title: Wordpress XML parsing issue in the Media Library leading to XXE Affected...

7.1CVSS6.7AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/13 7:39 p.m.6 views

wordpress-cve-2021-29447

WordPress CVE-2021-29447 exploit Exploit WordPress Media Library XML authenticated External Entity Injection XXE to exfiltrate files. Patched in WordPress 5.7.1. Required valid WordPress credentials to interact with Media Library. Usage root@kitploit: python3 wordpress-cve-2021-29447.py -l...

7.1CVSS7.1AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/13 4:36 p.m.10 views

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

7.1CVSS7AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/13 4:14 p.m.6 views

CVE-2021-29447

WordPress XXE Vulnerability : CVE-2021-29447 A user with the ability to upload a malicious WAVE file like an Author can exploit an XML parsing issue in the Media Library in WordPress leading to XXE attacks and that could lead to file system disclosure Vulnerable code XML External Entity XXE...

7.1CVSS6.6AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/13 3:52 p.m.10 views

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment root@kitploit: cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds root@kitploit: sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan...

9.8CVSS8.5AI score0.8589EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/13 6:25 a.m.8 views

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

7.1CVSS7AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/12 2:58 p.m.13 views

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - Authenticated Author+ XXE https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ usage: -l LHOST example: 127.0.0.1 -n NAME example: payload.wav -dn DTDNAME example: evil.dtd -r READ example: ../wp-config.php evil-wav-dtd-xxe.py: error: the...

7.1CVSS6.9AI score0.85719EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/11 4:39 p.m.7 views

CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library Plugin 3.10 CVE-2023-4634 Info Patrowl discovered An unauthenticated RCE Vulnerability on Media-Librairy-Assistant Wordpress Plugin in version 3.10. The exploit is not trivial and requires just a little setup explained bellow. Global...

9.8CVSS8.3AI score0.8589EPSS
SaveExploits6References1
NVD
NVD
added 2026/09/11 8:16 a.m.8 views

CVE-2026-6642

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

6.4CVSS0.00217EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/11 8:16 a.m.10 views

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

6.4CVSS0.00217EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/11 8:16 a.m.7 views

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00241EPSS
SaveExploits0References10
CVE
CVE
added 2026/09/11 7:39 a.m.19 views

CVE-2026-6642

The Media Library Assistant WordPress plugin (versions up to and including 3.35 ) is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. The root cause is insufficient output escaping in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-...

6.4CVSS5.8AI score0.00217EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/11 7:39 a.m.11 views

EUVD-2026-76009

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS5.9AI score0.00241EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/09/11 7:39 a.m.43 views

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00241EPSS
SaveExploits0References10
CVE
CVE
added 2026/09/11 7:39 a.m.15 views

CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

6.4CVSS5.9AI score0.00241EPSS
SaveExploits0References10
Rows per page
Query Builder