CVE-2026-1357

🧨 CVE-2026-1357 – Ferramenta de Exploração de Chave Nula WPvivid CVE-2026-1357.py Migração, Backup, Staging – WPvivid Backup & Migration ≤ 0.9.123 Vulnerabilidade: Upload Arbitrário de Arquivo Não Autenticado → Execução Remota de Código CVE: CVE-2026-1357 – CVSS 9.8 Crítico GitHub:...

CVE-2025-27407

CVE-2025-27407 GitLab-Podman-Labor Minimales rein lokales Labor zum Nachweis, dass der GitLab-Direct-Transfer-HTTP-Pfad den verwundbaren graphql-ruby-Introspection-Schema-Loader erreicht. Das Labor betreibt einen einzelnen verwundbaren GitLab-CE-Container; das PoC-Skript startet seinen simulierte...

CVE-2025-9286

CVE-2025-9286 Appy Pie Connect for WooCommerce = 1.1.2 - Autorizzazione mancante che consente l'Escalation dei privilegi non autenticata ⚠️ Appy Pie Connect for WooCommerce = 1.1.2 - Autorizzazione mancante che consente l'Escalation dei privilegi non autenticata tramite resetuserpassword 📝...

CVE-2025-8359

CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Script di exploit: CVE-2025-8359.py 📋 Descrizione CVE: CVE-2025-8359 Tipo di vulnerabilità: Bypass dell'autenticazione Prodotto interessato: AdForest - Tema WordPress per Annunci Classificati Versioni interessate: Fino alla 6.0.9 inclusa...

CVE-2025-7441

CVE-2025-7441 StoryChief data - sizes - full che punta a un URL arbitrario. StoryChief non esegue una validazione sufficiente del tipo/contenuto del file né limita la fonte dell'URL, consentendo al plugin di recuperare la risorsa remota e salvarla nella directory degli upload del sito. Non c'è un...

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello ECH, a privacy standard that prevents networks fro...

ZSC

OWASP ZSC DIESE SOFTWARE WURDE ENTWICKELT, UM ANTIVIREN-TECHNOLOGIEN HERAUSZUFORDERN, NEUE VERSCHLÜSSELUNGSMETHODEN ZU ERFORSCHEN UND SENSITIVE OPEN-SOURCE-DATEIEN MIT WICHTIGEN DATEN ZU SCHÜTZEN. MITWIRKENDE UND DIE OWASP-STIFTUNG ÜBERNEHMEN KEINE VERANTWORTUNG FÜR RECHTSWIDRIGE NUTZUNG. OWASP Z...

CVE-2025-7401

CVE-2025-7401 Premium Age Verification / Restriction for WordPress = 3.0.2 - Leitura e Escrita Arbitrária de Arquivos não Autenticada 🧾 Premium Age Verification / Restriction for WordPress = 3.0.2 — Leitura e Escrita Arbitrária de Arquivos não Autenticada 📝 Descrição O plugin "Premium Age...

I-See-You

I-See-You ISeeYou è uno strumento Bash e Javascript per trovare la posizione esatta degli utenti durante attività di social engineering o phishing. Utilizzando le coordinate esatte della posizione, un attacker può effettuare una ricognizione preliminare che lo aiuterà a condurre ulteriori attacch...

CVE-2025-6758

Real Spaces - Tema de Diretório de Propriedades para WordPress ≤ 3.6 Escalação de Privilégios Não Autenticada para Administrador via imicagentregister 📝 Descrição CVE-2025-6758 Pontuação CVSS: 9.8 Crítica O Real Spaces - Tema de Diretório de Propriedades para WordPress é vulnerável à escalada de...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Caricamento Arbitrario di File Non Autenticato 🚀 StoreKeeper for WooCommerce = 14.4.4 - Exploit di Caricamento Arbitrario di File Non Autenticato 📝 Descrizione Il plugin StoreKeeper for WooCommerce per WordPress è vulnerabile a caricamenti...

SwiftBelt

SwiftBelt Informazioni SwiftBelt è un enumeratore per macOS ispirato allo strumento di enumerazione Seatbelt basato su Windows di @harmjoy. SwiftBelt non utilizza utility da riga di comando, ma usa codice Swift sfruttando il Cocoa Framework, le librerie Foundation, le librerie OSAKit, ecc. per...

Dejavu

DejaVU - Open-Source-Täuschungsplattform DejaVu Teil von Camolabs.io ist eine Täuschungsplattform, die zum Bereitstellen von Decoys sowohl in der Cloud derzeit unterstützen wir AWS als auch im internen Netzwerk verwendet werden kann. Dies ist unser Vortrag auf der Blackhat Europe, in dem wir...

exch_CVE-2021-42321

exchCVE-2021-42321 Dies ist das Tool, das im Artikel 《DotNet安全-CVE-2021-42321复现》 des 7bits Sicherheitsteams behandelt wird Die TypeConfuse-Kette wird geändert, um in eine Datei zu schreiben, und bypass windows definder deaktiviert den Startvorgang der w3wp.exe. Überschreiben Sie die Originaldatei...

win-brute-logon

सूचना 1: हमें यह घोषणा करते हुए खुशी हो रही है कि हमारे वर्तमान टूल को PowerShell संस्करण में पोर्ट किया गया है। इसका मतलब है कि उपयोगकर्ता अब PowerShell कमांड लाइन से सीधे टूल तक पहुँच सकते हैं और उसका उपयोग कर सकते हैं, जिससे यह और भी अधिक सुविधाजनक और कुशल हो जाता है। हमारा मानना है कि यह नया...

CVE-2025-4796

CVE-2025-4796 Eventin Depois que o e-mail é alterado para um endereço controlado pelo atacante, o fluxo padrão de redefinição de senha do WordPress pode ser usado para assumir a conta. 🧰 Script...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Upload Arbitrario di File Non Autenticato 🚨 Flex QR Code Generator ≤ 1.2.5 - Upload Arbitrario di File Non Autenticato 📝 Descrizione Il plugin Flex QR Code Generator per WordPress è vulnerabile al caricamento arbitrario di file a causa della mancata...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...