112673 matches found
CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...
CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...
CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...
EUVD-2026-91451
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...
CVE-2026-104441 YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the valeur action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.p...
CVE-2026-104441
Versions of YesWiki prior to 4.6.7 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause lies in the {{valeur}} action's url parameter, which allows remote attackers to force the server to fetch content from arbitrary hosts and ports. By submitting the action th...
cve-2026-31431
CVE-2026-31431 — Copy Fail: Linux Kernel LPE Research Lab Educational purposes only. Do NOT use on systems without explicit authorization. Index Description of the vulnerability Affected components How it works Lab setup Docker PoC — Demonstration Mitigation References Vulnerability Description...
CVE-2026-64638-WordPress-Core-XSS2Shell
CVE-2026-64638 — Nuclei Detection Template Template Nuclei for non-intrusive detection of XSS2Shell , a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain. ⚠️ This template only detects the...
CVE-2026-100107
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-100107 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
EUVD-2026-91252
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-100107
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.2 . The root cause is insufficient input sanitization and output escaping associated with the 'comment' parameter , specifically involving an SVG Comment Conte...
EUVD-2026-91247
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...
CVE-2024-2473
CVE-2024-2473 — WPS Hide Login Page Identifier A professional Python scanner to detect Login Page Disclosure in WordPress sites running WPS Hide Login ≤ 1.9.15.2 Coded byVenexy Table of Contents Overview Vulnerability Details How It Works Requirements Installation Usage Output Example Disclaimer...
EUVD-2026-91207
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...
CVE-2026-97318
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect...
EUVD-2026-91197
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect...
what-wordpress
what-wordpress WordPressサイトのフロントページに表示されているすべてのテーマとプラグインを抽出するツール。...
grafana-bruteforce
grafana-bruteforce A tool that takes a combo username and password list and will attempt to bruteforce grafana login page. Grafana will lock you out after 5 attempts so you need to ensure your proxy has multiple external ip's. How to Run Use supplied combo list python3 grafana-brute.py -u...