WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

WordPress Pie Register plugin before 3.7.0.1 is susceptible to cross-site scripting. The plugin does not sanitize the invitaioncode GET parameter when outputting it in the Activation Code page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

WordPress Pie-Register <2.0.19 - Cross-Site Scripting

WordPress Pie Register before 2.0.19 contains a reflected cross-site scripting vulnerability in pie-register/pie-register.php which allows remote attackers to inject arbitrary web script or HTML via the invitaioncode parameter in a pie-register page to the default URL. id: CVE-2015-7377 info: nam...

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

WordPress Pie Register <3.8.2.3 - Open Redirect

WordPress Pie Register plugin before 3.8.2.3 contains an open redirect vulnerability. The plugin does not properly validate the redirection URL when logging in and login out. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute...

GLUFS

Getting Leaks Using Format String. root@kitploit: .d8888b. 888 888 888 8888888888 .d8888b. d88P Y88b 888 888 888 888 d88P Y88b 888 888 888 888 888 888 Y88b. 888 888 888 888 8888888 "Y888b. 888 88888 888 888 888 888 "Y88b. 888 888 888 888 888 888 "888 Y88b d88P 888 Y88b. .d88P 888 Y88b d88P...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

CVE-2025-34077

CVE-2025-34077 — WordPress Pie Register ≤ 3.7.1.4 - 管理员权限提升（未认证） 💀 作者 Mrj Haxcore 🧠 漏洞摘要 WordPress 的 Pie Register 插件（版本 ≤ 3.7.1.4）暴露了一个未认证的端点，攻击者只需 POST 一个特定的负载即可 劫持管理员会话 。 利用该漏洞可 窃取用户 ID 1 （通常为 admin）的会话 cookies，无需任何登录凭据。 📦 受影响软件 插件名称：Pie Register 版本： wordpressloggedinxxxxxx = ! 请在浏览器或 curl、Burp...

idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...

CVE-2021-24647

CVE-2021-24647 CVE-2021-24647 Pie Register 3.7.1.6 - Inicio de sesión arbitrario no autenticado Información root@kitploit: usage: exploit.py -h -w URL -p PATH options: -h, --help show this help message and exit -w URL, --url URL URL of the WordPress site -p PATH, --path PATH Path of the Login Pag...

Web-Penetration-Test

Web-Penetration-Test Explotando vulnerabilidades de WordPress CVE-2025-34077, bypass de autenticación mediante inyección de cookies y escalada de privilegios a root. Parte de mi Especialización en Ciberseguridad. Día 1: Hackeando mi primer sitio web Informe de laboratorio: Explotando el servidor...

gdbfuzz

GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...

CVE-2025-9286

CVE-2025-9286 Appy Pie Connect for WooCommerce = 1.1.2 - 授权缺失导致未认证权限提升 ⚠️ Appy Pie Connect for WooCommerce = 1.1.2 - 通过 resetuserpassword 的授权缺失导致未认证权限提升 📝 描述 Appy Pie Connect for WooCommerce 的 WordPress 插件在所有版本（包括 1.1.2）中，由于 resetuserpassword REST 处理程序缺少授权，存在权限提升漏洞。...

CVE-2025-34077

CVE-2025-34077 未经身份验证的管理员会话劫持 - Pie Register 插件 版本 ≤ 3.7.1.4 📌 描述 该漏洞利用针对 Pie Register WordPress 插件 （版本 ≤ 3.7.1.4）中的漏洞，允许未经身份验证即可劫持管理员会话 。 🛡️ 此工具仅用于授权的测试和研究。请勿将其用于您没有所有权或未获得明确许可的系统。 🧪 概念验证 🚀 使用方法 root@kitploit: python3 CVE-2025-34077.py http://target.site 示例： root@kitploit: python3...

CVE-2022-2586

CVE-2022-2586 gcc exploit.c -o exploit -lmnl -lnftnl -no-pie -lpthread...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

用于绕过 NX PIE SSP ASLR 这个PoC不稳定。 有时HTTP服务会宕机。 你应该修复morecore-offset并选择正确的libc-file。...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fqpie: prevent dismantle issue For some reason, the fqpieDestroy function did not copy the working code from pieDestroy and other related functions, resulting in a persistent bug. Before calling...

CVE-2026-14358 Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Charts Extension: from before 1.43.9,1.44.6,1.45.4...

CVE-2026-14358 Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Charts Extension: from before 1.43.9,1.44.6,1.45.4...

CVE-2026-14358

The CVE-2026-14358 affects the Wikimedia Foundation MediaWiki Charts Extension and indicates a Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. Affected versions are before 1.43.9, 1.44.6, and 1.45.4. The vulnerability is described as a stored XS...