CVE-2023-35813

CVE-2023-35813 CVE-2023-35813 es una prueba de concepto utilizada para determinar si una instancia de Sitecore es vulnerable analizando un Encabezado de respuesta del servidor en busca de modificaciones. Hecho con amor por heretic 3...

SparstanBoogie

SparstanBoogie's origins were tested reportedly on iOS/iPadOS 15.2 - 16.7 RC 20H18 and 17.0 however, tests have been conducted up to 26.1 26.1. Also any testing on devices above or under whats been reported is welcomed as it may come back in newer devices so theres no reason to shrug off any good...

CVE-2024-4875

CVE-2024-4875 HT Mega – Absolute Addons For Elementor = 2.5.2 - Falta de Autorización para Actualización de Opciones Descripción: El plugin HT Mega – Absolute Addons For Elementor para WordPress es vulnerable a la modificación no autorizada de datos o pérdida de datos debido a la falta de...

CVE-2026-78306

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

CVE-2021-42562

CVE-2021-42562: Control de Acceso Inadecuado en MITRE Caldera Caldera versiones =2.8.1 no segrega adecuadamente los privilegios de los usuarios, lo que da como resultado que los usuarios no administradores tengan acceso para leer y modificar la configuración u otros componentes que solo deberían...

CVE-2024-22198_Checker

CVE-2024-22198 - ejecución remota de código autenticado en Nginx-ui Descripción Esta herramienta está diseñada para comprobar de forma remota la versión de Nginx-ui y notificar si es vulnerable a CVE-2024-22198. Nginx-UI es una interfaz web para gestionar configuraciones de Nginx. Es vulnerable a...

CVE-2021-1675_CarbonBlack_HuntingQuery

Consulta de caza en CarbonBlack para CVE-2021-1675 PrintNightmare 1 Basado en la regla Sigma para detectar el código POC filemodname:c:\windows\system32\spool\drivers\x64\3\old\1\123 2 Basado en la regla Sigma para detectar el código POC...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Falta de autorización a través de handleRequest Descripción: El plugin RumbleTalk Live Group Chat para WordPress es vulnerable a acceso no autorizado de datos, modificación de datos y pérdida de datos debido a una falta de comprobación de...

CVE-2025-66683

CVE-2025-66683 Existe una vulnerabilidad de Cross-Site Request Forgery CSRF en la funcionalidad de actualización de perfil de administrador de CarRentalMS v2.0. El endpoint afectado no implementa protecciones anti-CSRF, lo que permite a un atacante realizar modificaciones no autorizadas del perfi...

CVE-2023-36845-Juniper-Vulnerability

CVE-2023-36845 Este script proporciona una Prueba de Concepto PoC automatizada para CVE-2023-36845, una vulnerabilidad que afecta a Junos OS de Juniper Networks en dispositivos de las series EX y SRX. Explota el componente J-Web, permitiendo la modificación remota de la variable PHPRC y una posib...

CVE-2023-42820

CVE-2023-42820 CVE-2023-42820 Descripción de la vulnerabilidad Vulnerabilidad de restablecimiento de contraseña en JumpServer USAGE V2 Update 1. Reestructuración completa 2. Nuevo: cuando no se reciben la cuenta y el correo electrónico, se utilizan la cuenta y el correo electrónico predeterminado...

yellow

| | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - just add blue Simple binary modifications that will trigger a canarytoken when a binary is executed. Ideal for boobytrapping production systems against attackers. Currently there are four methods:...

CVE-2026-97337

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

CVE-2026-91078

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-92437

The Mailchimp for WooCommerce WordPress plugin, in versions prior to 6.3 , is vulnerable to unauthorized data modification. The application fails to implement authentication , nonce , or ownership checks when processing customer abandoned-cart records identified via request-supplied data. This fl...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

EUVD-2026-91944

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...