90DaysOfCyberSecurity

90-Day Cybersecurity Study Plan 📚 Table of Contents Introduction Goals and Audience Daily Breakdown Day 1-7: Network+ Concepts Day 8-14: Security+ Concepts Day 15-28: Linux Tutorials Day 29-42: Python Day 43-56: Traffic Analysis Day 57-63: Git Day 64-70: ELK Day 71-77: GCP or AWS or Azure Day...

distributed-system-testing

Distributed Systems Testing Skills Two skills that help an AI coding agent design meaningful tests, run them, and explain the results for systems that store data or run across multiple processes or machines. Start with a product promise—such as “once saving succeeds, the data is still there after...

security-study-plan

A Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps, and so on with free/paid resources, tools, and concepts to excel. It will cover but not limited to: Done 1. Common Skills for Security Study Plan 2. AWS Security...

CVE-2026-126462

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user...

CVE-2026-126462

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated users with Eye Exam edit permissions can inject malicious scripts via the Next Visit Orders PLAN[] field. By storing a payload that closes the textarea in view.php , an attacker can execute Jav...

EUVD-2026-124962

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user...

ai-pentest-agent

ai-pentest-agent A small, standalone autonomous pentest agent, plus a purpose-built vulnerable target to run it against. Built to show, end to end, how an AI pentesting agent actually works — not a black box, just a plan→act→judge loop, a handful of generic skills, a gate that vetoes destructive...

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

TTPRunner

TTPRunner Autonomous TTP execution agent for purple team operations Feed it a threat report. It builds the attack plan. You approve. It executes. Features Feature| Description ---|--- Multi-Format Parsing| PDF LLM-powered, STIX 2.1, Markdown, URLs - paste a threat report and go LLM Analysis|...

CVE-2026-123661

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

EUVD-2026-123196

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

CVE-2026-123661

The ProfilePress WordPress plugin (versions 4.16.13 - 4.17.3 ) contains a vulnerability where it fails to verify if a membership plan is active when a user utilizes the checkout process to modify an existing subscription. This Missing Authorization (CWE-862) flaw allows subscribers holding any va...

WordPress ProfilePress plugin 4.16.13-4.17.3 - Subscriber+ Inactive Membership Plan Subscription vulnerability

Subscriber+ Inactive Membership Plan Subscription vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ProfilePress versions 4.16.13-4.17.3...

CVE-2026-123661 ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change Checkout

The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans tha...

CVE-2026-123657 ProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan ID

The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them...

WordPress ProfilePress plugin < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment vulnerability

Unauthenticated Inactive Membership Plan Enrollment vulnerability discovered by Charles Vosburgh in WordPress Plugin ProfilePress versions 4.17.6...

CVE-2026-123657

The ProfilePress WordPress plugin, in versions prior to 4.17.6 , is vulnerable to an Unauthenticated Inactive Membership Plan Enrollment flaw. The root cause is the failure to reject negative membership plan identifiers before verifying if a plan is active. This allows unauthenticated visitors to...

EUVD-2026-123157

The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan...

CVE-2026-123657: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking…

The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them...

CVE-2026-120811

A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing...