EUVD-2026-76792

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-84023

BEAR – Bulk Editor and Products Manager Professional for WooCommerce (versions before 1.2.2 ) fails to verify a CSRF nonce or check user capabilities before updating taxonomy terms. An attacker can exploit this by tricking a logged-in privileged user into visiting a crafted page, resulting in arb...

EUVD-2026-76790

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-77752

Temporary Login Without Password (WordPress plugin, versions 1.5–1.9.8 ) contains a privilege escalation flaw: the plugin fails to verify that the user requesting a temporary login already holds network super admin rights before granting those rights to the new or existing account. On a multisite...

EUVD-2026-76783

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

EUVD-2026-76815

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...

CVE-2020-9802

Este repositorio no tiene un README...

diaggetroot

此存储库没有 README。...

DetExploit

此 README 为英文版本。 如需查看日文版本，请参阅READMEJAPANESE.md。 信息 最后更新: 2019/10/04 您好，感谢您访问此仓库。 您可能注意到有一段时间没有提交记录……但开发工作仍在进行中！！！ 目前，我正在用 C++ 重写整个程序，以减小二进制文件大小并获得更多优势。 这是发布我们程序的重要步骤，请谅解……: 我已经准备了一些里程碑，您可以查看它们！！ root@kitploit: 日程 1. 从 Python 迁移到 C++ 以减小二进制文件大小 2. 通过 GitHub Releases 发布二进制文件 3...

HORiZonstack

Este repositorio no tiene un README...

OWASSRF

Este repositorio no tiene un README...

CVE-2018-1270_EXP

此存储库没有 README。...

cve-2020-1938

此存储库没有 README。...

CVE-2015-1328

tes...

CVE-2022-1388

此存储库没有 README。...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution 未授权扫描器 针对影响 Slider Revolution WordPress 插件（版本 6.7.0）的 CVE-2024-34444 的专业批量扫描器 Banner 🎯 描述 CVE-2024-34444 是 Slider Revolution WordPress 插件（版本 6.7.0）中的一个缺失授权 漏洞。该扫描器通过 REST API 端点 /wp-json/revslider/v1/slider/save 自动检测并利用易受攻击的安装。 技术细节 CVE ID : CVE-2024-34444 CVSS ...

CVE-2025-48384-p

此存储库没有 README。...

CVE-2026-41452-PoC

CVE-2026-41452 — Omisión de autenticación en el instalador de Krayin CRM → Toma de control del administrador CVSS 9.8 Crítico · CWE-287 / CWE-306 · Informe de Jiva · Aviso de VulnCheck Resumen El instalador de Krayin CRM expone POST /install/api/admin-config-setup además de run-migration,...

pac4j-check

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...