295204 matches found
CVE-2023-32117
CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...
CVE-2023-6700
CVE-2023-6700 Cookie Information | Free GDPR Consent Solution = 2.0.22 - Authenticated Subscriber+ Arbitrary Options Update Description: CVE-2023-6700 The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability che...
CVE-2022-24707
PoC for CVE-2022-24707 SQL Injection Vulnerability on Puncher plugin. A POST request can be crafted to exploit SQL Injection and leak database contents. This is tested on Anuko Time Tracker 1.20.0.5640. python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host...
LogJackFix
LogJack Fix A spigot plugin to fix CVE-2021-44228 Log4j remote code execution vulnerability, to protect Minecraft clients. Building gradle build License Licensed under GPLv3 Copyright c 2021 lordpipe Contributing By making a contribution to this repository, I certify that: a The contribution was...
CVE-2025-2294
CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI Vulnerability in Kubio AI Page Builder for WordPress 🧱 🔍 Overview CVE-2025-2294 is a critical 🔥 Local File Inclusion LFI vulnerability affecting the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. This flaw...
CVE-2023-46197
CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...
CVE-2025-6934
CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...
CVE-2023-22518
CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...
CVE-2023-4636
CVE-2023-4636 The vulnerability in the limelight is an unauthenticated remote code execution RCE issue stemming from insufficient controls on file paths occurring during image processing via Imagick. It enables adversaries to supply files via FTP, leading to local file inclusion and remote code...
CVE-2024-11972-POC
Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site default: http://localhost/wordpress/. -p PLUGIN, --plugin PLUGIN Plugin na...
CVE-2024-22145
CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...
CVE-2025-54726
CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2024-56058
CVE-2024-56058 VRPConnector = 2.0.1 - Unauthenticated PHP Object Injection Description The VRPConnector plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers t...
CVE-2024-9796
CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5×tamp=13672261755853'...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 This repository contains a Proof of Concept PoC script for exploiting a privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000 , allows unauthenticated users to gain...
CVE-2025-55182-burpscanner
CVE-2025-55182-burpscanner A Burp Suite passive scanning plugin for detecting CVE-2025-55182, using JDK 17 Plugin Usage: Default scanning of history / right-click active scan. When a vulnerability is detected, it automatically goes to the CVE-2025-55182 module. Deduplication Deduplication Mechani...
CVE-2025-12030
CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress Plugin Keywords: CVE-2025-12030, ACF to REST API vulnerability, IDOR, WordPress security, authenticated exploit, WordPress plugin vulnerability, CWE-639, ACF field modification, authorization bypass, WordPress CVE 2025,...
CVE-2021-24545
CVE-2021-24545 WP HTML Author Bio alert/XSS/ Then view post made by the author to trigger the XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...
poc-cve-xss-inventory-press-plugin
Update - 6-23-2023 The CVE-2023-2579 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Details Title: Authenticated Reflected Cross-Site Scripting in InventoryPress Plugin for WordPress CMS Date: 2023-04-21 Autho...
CVE-2025-34085
CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....