CVE-2026-0740

CVE-2026-0740 🧩 Übersicht CVE-2026-0740 ist eine nicht authentifizierte Schwachstelle für beliebige Datei-Uploads, die Folgendes betrifft: Ninja Forms File Uploads ≤ 3.3.26 WordPress-Plugin Dieser Fehler ermöglicht es Angreifern, ohne Authentifizierung beliebige Dateien auf den Server hochzuladen...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Scanner di vulnerabilità multi-thread per il problema di path traversal nel caricamento file di Ninja Forms su WordPress. Descrizione main.py scansiona un elenco di target WordPress per determinare se il plugin Ninja Forms File Uploads è vulnerabile a...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Risposta:...

CVE-2026-0740-mass

CVE-2026-0740 — Motore di exploit per target di massa Autore: 0xNuts Contributore: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC per CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload che può portare a RCE. La vulnerabilità iniziale è...

ninja-forms-brute

Ninja Forms 3.6.8 - Offenlegung von E-Mail-Adressen ohne Authentifizierung Beschreibung Das Plugin löscht die temporären Dateien nicht, die beim Exportieren von Einsendungen erstellt werden, was es nicht authentifizierten Angreifern ermöglichen könnte, sie herunterzuladen und an sensible...

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2024-7354 info: name: Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting...

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begindate, enddate, or formid parameters. This can allow an attacker to steal cookie-based authentication credentials a...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Caricamento File Arbitrario Non Autenticato fino a RCE Exploit per CVE-2026-0740 scoperto da Selim Lanouar whattheslime. Per un'analisi tecnica completa, leggi l'articolo completo sul blog di Lexfo. Disclaimer Questo repository è fornito...

CVE-2023-37979

CVE-2023-37979 Unauthentifizierte Reflected Cross-Site Scripting XSS Schwachstelle im Saturday Drive Ninja Forms Contact Form Plugin = 3.6.25 Versionen. PoC und Checker , nur zu Bildungszwecken 'python3 exploit.py https://target.com'...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Caricamento Arbitrario di File Non Autenticato. Descrizione : Il plugin Ninja Forms - File Uploads per WordPress è vulnerabile al caricamento arbitrario di file non autenticato a causa della mancanza di validazione del tipo di file e della mancan...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

CVE-2026-0740

ninja.py Uno script sperimentale/strumento che sfrutta gli endpoint di upload file per il plugin Ninja Forms su siti WordPress. Invia richieste in sequenza ai target elencati in list.txt e scrive gli upload riusciti nel file shell.txt. Requisiti Python 3 requests solitamente installato insieme a...

The vulnerability of the NF_FU_AJAX_Controllers_Uploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin allows a attacker to execute arbitrary code.

The vulnerability of the NFFUAJAXControllersUploads::handleUpload function in the File Uploads extension of the Ninja Forms plugin is related to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

EUVD-2026-54201

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256

The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...