WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress UserPro 4.9.32 - Cross-Site Scripting Detection

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress UserPro 4.""" from kittysploit import from...

WordPress a3 Lazy Load - Full Path Disclosure Detection

WordPress Plugin a3 Lazy Load plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin a3 Lazy Load plugin files are publicly...

WordPress Astra - Full Path Disclosure Detection

WordPress Astra Theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Astra Theme files are publicly accessible without ABSPATH protection...

WordPress Load More Anything - Full Path Disclosure Detection

WordPress Plugin Load More Anything files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Load More Anything files are publicly accessibl...

WordPress Advanced Responsive Video Embedder - Full Path Disclosure Detection

WordPress Advanced Responsive Video Embedder plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Responsive Video Embedder...

WordPress Plugin iThemes Security - Full Path Disclosure Detection

WordPress Plugin iThemes Security files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin iThemes Security files are publicly accessible...

Twig PHP <2.4.4 template engine - SSTI Detection

A vulnerability in Twig PHP allows remote attackers to cause the product to execute arbitrary commands via an SSTI vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Twig PHP allows remote attackers to cause the product to execute arbitrary commands via an .""" from...

Roundcube ≤ 1.6.10 Post-Auth RCE (CVE-2025-49113)

Authenticated RCE in Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11. Unsafe from handling in settings/upload.php allows PHP object deserialization via a CryptGPGEngine gadget command execution as the web server user. !/usr/bin/env python3 -- coding: utf-8 -- """Roundcube ≤ 1.6.10 post-au...

WordPress Elementor Pro - Full Path Disclosure Detection

WordPress Plugin Elementor Pro plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Elementor Pro plugin files are publicly...

WordPress Plugin Google Tag Manager - Full Path Disclosure Detection

WordPress Plugin Google Tag Manager files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Google Tag Manager files are publicly accessibl...

WordPress Duplicate Page - Full Path Disclosure Detection

WordPress Plugin Duplicate Page files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Duplicate Page files are publicly accessible withou...

WordPress Configuration wp-env - Exposure Detection

Detected the WordPress wp-env.json configuration file publicly accessible, potentially revealing the PHP version, installed plugins, themes, and development environment details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the WordPress wp-env.""" from kittysploit import from...

WordPress Menu Image - Full Path Disclosure Detection

WordPress Plugin Menu Image plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Menu Image plugin files are publicly accessible...

WordPress Joinchat - Full Path Disclosure Detection

WordPress Plugin Joinchat files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Joinchat files are publicly accessible without ABSPATH...

WordPress Twenty Sixteen - Full Path Disclosure Detection

WordPress Twenty Sixteen theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Twenty Sixteen theme files are publicly accessible without...

WordPress SVG Support - Full Path Disclosure Detection

The WordPress SVG Support plugin was detected to have publicly accessible PHP files without ABSPATH protection, which exposed sensitive server path information. Direct access to vendor/composer files triggered PHP fatal errors that revealed the full WordPress filesystem path. !/usr/bin/env python...

WordPress Plugin SG Optimizer - Full Path Disclosure Detection

WordPress Plugin SG Optimizer Plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin SG Optimizer Plugin files are publicly...