CVE-2021-29447

CVE-2021-29447 POC to exploit WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. More about this CVE here Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress website with Media Library vulnerable to XXE Injection. root@kitploit: python lfi.py -u manager -p...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

CVE-2026-12855

creationtimestamp| type| source ---|---|--- 2026-09-09 04:30:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mv2pbpue7o24 2026-09-09 04:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117239200044346852 2026-09-09 05:03:46+00:00| seen|...

CVE-2026-15667

creationtimestamp| type| source ---|---|--- 2026-09-09 03:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mv2kaud5lu2b 2026-09-09 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117238846309001976 2026-09-09 03:01:51+00:00| seen|...

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

Import Legacy Media <= 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4535 info: name: Import Legacy Media = 0.1 - Cross-Site...

WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload

The Frontend File Manager plugin 4.0 and N-Media Post Front-end Form plugin 1.1 for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. id:...

CVE-2026-75696

creationtimestamp| type| source ---|---|--- 2026-09-09 02:14:31+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv2hoq32wq2g...

CVE-2026-87529

A flaw was found in Media in Google Chrome. This numeric truncation error allows a remote attacker to potentially execute arbitrary code outside the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-87628

creationtimestamp| type| source ---|---|--- 2026-09-09 01:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/117238492477381898 2026-09-09 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mv2f7xtw662q 2026-09-10 05:16:02+00:00| seen|...

CVE-2026-87440

A flaw was found in Google Chrome. This vulnerability, an out-of-bounds read in the Media component, allows a remote attacker to execute arbitrary code. By enticing a user to visit a specially crafted HTML page, the attacker can exploit this flaw to run malicious code within the browser's securit...

DEBIAN-CVE-2026-87638

Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87638

Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-87529

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87529

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-87456

Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87456

Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87440

Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-87440

Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87456

A flaw was found in the Media component of Google Chrome. A remote attacker, after compromising the renderer process, could exploit an uninitialized resource vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to read sensitive memory outsid...