CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

WordPress-Exploit-CVE-2024-1071

WordPress CVE 2024-1071 SQL Exploit This exploit, which runs on WordPress versions 2.1.3 to 2.8.2, allows unauthenticated attackers to add additional SQL queries to existing queries that can be used to pull sensitive information from the database. Dork: body="/wp-content/plugins/ultimate-member" ...

CVE-2026-65591

CVE-2026-65591 Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions ...

CVE-2026-119656 CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...

CVE-2026-119655

CoreShop versions through 1.5.5 are vulnerable to an unauthenticated SQL injection in the api/Good/GetGoodsPageList endpoint. The root cause is an unvalidated order parameter appended to an ORDER BY clause, which allows attackers to bypass SqlSugar's field check . Exploitation via boolean-based o...

CVE-2026-46552

CVE-2026-46552 NocoDB Shared-Base Links Could Invite Real Base Members and Survive Share Revocation Intro I found this issue while reviewing NocoDB , with a simple security question in mind: Can a public shared-base link cross the boundary from temporary shared access into real authenticated base...

CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk! thanks for ©gbrsh, I improved the tool a bit...

CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2023-3460

Ultimate Member - Overview Welcome to the Ultimate Member GitHub repository! Ultimate Member is a powerful and flexible user profile and membership plugin for WordPress but Sometimes Plugins has some vulnerability and lead to website compromisation Important Notice: Please note that the version o...

CVE-2024-1071

CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2024-1071-SQL-Injection

Proof of concept CVE-2024-1071: WordPress Vulnerability Exploited Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all...

CVE-2023-3460

CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

WordPress WPCOM Member <= 1.7.6 - SQL Injection

WPCOM Member plugin for WordPress up to 1.7.6 contains a time-based SQL Injection caused by insufficient escaping and lack of preparation on the 'userphone' parameter, letting unauthenticated attackers extract sensitive information, exploit requires sending crafted 'userphone' parameter. id:...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2023-3460

CVE-2023-3460 The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This script perform an exploit for this vulnerability and scan different...

S2-053-CVE-2017-12611

S2-053-CVE-2017-12611 A simple script for exploit RCE for Struts 2 S2-053CVE-2017-12611 Usage exploit.py Example $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...

CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...