CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

CVE-2026-84166

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84166 Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

EUVD-2026-97243

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

CVE-2026-84166

The Hotel Booking WordPress plugin versions through 3.8 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within its administrative booking order management component. The lack of proper CSRF protection allows an attacker to trick a logged-in administrator into performing unauthorized act...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affected: Ghost 3.24.0 – 6.19.0 Fixed in: Ghost 6.19.1 Auth required: None — Content API key is public Impact: Unauthenticated read of the entire database credentials, API keys Vulnerability slug-filter-order.js interpolates user-supplied...

CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL injection Runnable proof-of-concept reproducer for the SQL injection in Apache InLong's audit-alert-rule query. The InLong manager mapper AuditAlertRuleEntityMapper.selectByCondition filters with safe MyBatis parameters, but sorts with $...

CVE-2026-84166: Cross-Site Request Forgery (CSRF)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

PT-2026-110478

Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description Cross-Site Request Forgery CSRF occurs when a web application fails to verify that a request was intentionally initiated by the user. The administrative booking order management lacks CSRF...

CVE-2026-109347: Improper Control of Generation of Code

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2024-9756

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756 📌 Overview This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to...

duplicut

Duplicut :scissors: Elimina rápidamente duplicados de listas de palabras masivas, sin cambiar el orden Creado por nil0x42 y colaboradores 📖 Resumen Hoy en día, la creación de listas de palabras para contraseñas generalmente implica concatenar múltiples fuentes de datos. Idealmente, las contraseña...

second-order

Second Order Escanea aplicaciones web para la toma de control de subdominios de segundo orden rastreando la aplicación y recolectando URLs y otros datos que coincidan con ciertas reglas o respondan de cierta manera. Instalación Desde binario Descarga un binario precompilado desde la página de...

PT-2026-110026

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-62117

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62118

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62116

Unauthenticated Cross Site Scripting XSS in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-39800

Unauthenticated Cross Site Scripting XSS in Additional Order Filters for WooCommerce = 1.24 versions...

CVE-2026-62118 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...