CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticated Arbitrary File Upload via Plugin Installation 🔥 Vulnerability Summary The WordPress theme Alone versions = 7.8.3 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to...

CVE-2024-11972-POC

Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

CVE-2025-1562

CVE-2025-1562 root@kitploit: POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Ejecución Remota de Código Uso root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message...

CVE-2026-66047

The ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability. The root cause is a weak 32-bit connect token in the ppress_connect_process AJAX handler , which can be brute-forced by an unauthenticated attacker. Once the token is ...

WordPress Really Simple Security plugin < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Charles Vosburgh in WordPress Plugin Really Simple SSL versions 9.8.0...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

CVE-2024-43998

CVE-2024-43998 root@kitploit: Blogpoet = 1.0.2 - Missing Authorization via blogpoetinstallandactivateplugins Published: 2024-08-29 00:00:00 Classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2024-43998 cpe: cpe:2.3:a:blogpoet:blogpoet::::::::...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2025-1639

🔓 Script di Exploit per CVE-2025-1639 📝 Descrizione Il plugin Animation Addons for Elementor Pro per WordPress è vulnerabile all'installazione non autorizzata di plugin arbitrari a causa di un mancato controllo delle capability nella funzione installelementorpluginhandler in tutte le versioni fin...

CVE-2025-55449

CVE-2025-55449 - Vulnerabilità di Remote Code Execution RCE in AstrBot Panoramica Questa repository contiene un proof-of-concept di exploit per CVE-2025-55449 , una vulnerabilità critica di Remote Code Execution RCE in AstrBot. La vulnerabilità consente a un attaccante di eseguire codice arbitrar...

CVE-2012-2593

Atmail - Catena di Exploit XSS-CSRF-RCE PoC atmail-rce.py: Sfrutta CVE-2012-2593 nell'interfaccia webmail di Atmail. atmail-csrf.js: File Javascript che sfrutta CVE-2012-2593 per effettuare un CSRF al fine di installare un plugin malevolo che esegue una reverse shell Plugin.php: Plugin di Atmail ...

halo-cve-2026-67919

halo plugin rce von einer URL Die Halo-Konsole erlaubt es Administratoren, Plugins zu installieren und zu aktualisieren, indem sie eine URL einfügen. Sie holt die angegebene URL, installiert das Jar, und der Code des Jars läuft auf dem Server. Keine Scheme-Prüfungen, keine Host-Prüfungen, Redirec...

CVE-2024-54369

CVE-2024-54369 Zita Site Builder = 1.0.2 - Autorizzazione mancante per l'installazione arbitraria di plugin Descrizione Il plugin Zita Site Builder per WordPress è vulnerabile all'accesso non autorizzato alle funzionalità a causa di un controllo delle capability mancante su una delle sue funzioni...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Autorizzazione mancante per l'installazione/attivazione arbitraria di plugin da parte di utenti autenticati Abbonato+ Descrizione: Il tema ColorMag per WordPress è vulnerabile ad accessi non autorizzati a causa di una mancata verifica delle capacità nella funzione...

CVE-2024-9707-Poc

CVE-2024-9707-Poc 🌐 Descrizione Questo script sfrutta la vulnerabilità nel plugin Hunk Companion per WordPress CVE-2024-9707, consentendo a utenti non autorizzati di installare e attivare plugin arbitrari tramite l'endpoint API REST /wp-json/hc/v1/themehunk-import. Caratteristiche...

CVE-2024-30485

CVE-2024-30485 Exploit 📌 Übersicht CVE-2024-30485 ist eine Schwachstelle mit hohem Schweregrad, die im Finale Lite -Plugin für WordPress Versionen = 2.18.0 gefunden wurde. Die Schwachstelle ermöglicht authentifizierten Benutzern Subscriber+ das Installieren und Aktivieren beliebiger Plugins ohne...