CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

EUVD-2026-91451

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

CVE-2026-104441

Versions of YesWiki prior to 4.6.7 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause lies in the {{valeur}} action's url parameter, which allows remote attackers to force the server to fetch content from arbitrary hosts and ports. By submitting the action th...

CVE-2026-104441 YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...

cve-2026-31431

CVE-2026-31431 — Copy Fail: Linux Kernel LPE 研究ラボ 教育目的のみ。明示的な許可なしにシステムで使用しないでください。 目次 脆弱性の説明 影響を受けるコンポーネント 動作の仕組み ラボのセットアップ（Docker） PoC — デモ 緩和策 参考文献 脆弱性の説明 フィールド| 値 ---|--- CVE| CVE-2026-31431 Alias| Copy Fail CVSS| 7.8 High タイプ| Local Privilege Escalation LPE 影響を受けるカーネル| 2017 – 2026 commit...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei Detection Template Nuclei テンプレート。WordPress Core の認証前の差分パーサー（differential parser）である XSS2Shell を非侵襲的に検出します。この脆弱性によりログインページへの DOM 要素の注入が可能になり、XSS → RCE のチェーンへの基盤となります。 ⚠️ このテンプレートは 検出のみ を行います（HTML レスポンスへのマーカーリフレクション段階）。完全なエクスプロイトチェーン（DOM clobbering、JSONP/SOME、Application...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-91252

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-100107 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.2 . The root cause is insufficient input sanitization and output escaping associated with the 'comment' parameter , specifically involving an SVG Comment Conte...

EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2024-2473

CVE-2024-2473 — WPS Hide Login ログインページ識別ツール WPS Hide Login ≤ 1.9.15.2 を実行しているWordPressサイトでログインページの漏洩を検出するプロフェッショナルなPythonスキャナー コード作成者：Venexy 目次 概要 脆弱性の詳細 動作の仕組み 必要条件 インストール 使用方法 出力例 免責事項 参考文献 概要 WPS Hide Login は、管理者がデフォルトの /wp-login.php URL...

EUVD-2026-91207

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...

CVE-2026-97318

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect...

EUVD-2026-91197

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect...

what-wordpress

what-wordpress WordPressサイトのフロントページに表示されているすべてのテーマとプラグインを抽出するツール。...

grafana-bruteforce

grafana-bruteforce ユーザー名とパスワードのコンボリストを受け取り、grafanaのログインページへのブルートフォース攻撃を試みるツールです。 Grafanaは5回の試行後にロックアウトされるため、プロキシが複数の外部IPアドレスを持つことを確認する必要があります。 実行方法 付属のコンボリストを使用する python3 grafana-brute.py -u http://localhost:3000 独自のコンボリストを使用する。 python3 grafana-brute.py -u http://localhost:3000 -f mycombo.txt 例...