CVE-2021-43798-Grafana-Exp

Grafana V8. Arbitrary File Read Exploit – Batch Verification Script Vulnerability Description Grafana is an open-source metrics analysis and visualization suite. It is commonly used as a visualizer for time series data and application analytics in infrastructure, and is also widely adopted in oth...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Unauthenticated Arbitrary File Upload Description WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation i...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Unauthenticated PHP Object Injection Description The DS.DownloadList plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2026-57829

Helix Ultimate Framework — Unauthenticated Stored XSS comajax → Admin Session-Riding → Full Account Takeover This is the strongest finding in this research folder — CRITICAL, fully confirmed end-to-end. Unlike the delete-only bug in helixultimatedeletepoc.md, this one has a real, working path to...

By-Poloss..-..CVE-2026-11551-PoC

CVE-2026-11551: Branda Plugin - Unauthenticated Privilege Escalation via Account Takeover Overview CVE ID : CVE-2026-11551 CVSS Score : 9.8 Critical Affected : Branda – White Label & Branding = 3.4.29 Patched : 3.4.31 Published : June 19, 2026 Vulnerability Description The Branda plugin for...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 We access the wordpress website where we will see that it has MFA activated through the vulnerable plugin: We must execute the PoC and provide the access credentials: Automatically, the browser will open using ...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🚨 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🛡️ Descriptio...

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 🐚 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 📝 Description The KiotViet Sync plugin for WordPress versions up to and including 1.8.5 is vulnerable to arbitrary file uploads, due to missing file type...

WeblogicScan

WeblogicScan Enhanced version of WeblogicScan, modified from rabbitmask's WeblogicScan V1.2. Original source project: https://github.com/rabbitmask/WeblogicScan DEFF Supports Python3 Fixed vulnerability detection false positives, vulnerability detection results are more accurate Added...

CVE-2024-36401-WoodpeckerPlugin

CVE-2024-36401-WoodpeckerPlugin Introduction Batch detection and exploitation of CVE-2024-36401, supporting custom memory shell injection 1. Batch detection capability 2. The backend has already filtered URLs just provide the URLs 3. Can custom generate memory shell for injection default memory...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2024-10400

CVE-2024-10400 The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'ratingfilter' parameter in all versions up to, and including, 2.7.6 versions Note : The exploit uses a time-based blind SQL injection check with a 5-second delay threshold. If the response time exceeds 5...

CVE-2025-6440-Poc-Exploit

WC Designer Pro — Unauthenticated Arbitrary File Upload Security Research Proof of Concept A non-destructive proof of concept for an unauthenticated arbitrary file-upload vulnerability affecting the WC Designer Pro WordPress plugin. Table of Contents Vulnerability Overview Security Impact Affecte...

CVE-2025-47646

🔐 CVE-2025-47646 – PSW Front-end Login & Registration = 1.12 📌 Plugin Information Plugin : PSW Front-end Login & Registration Vulnerable Version : = 1.12 CVE : CVE-2025-47646 Severity : High CVSS 9.8 Vulnerability Type : Broken Authentication Privilege Required : Unauthenticated Patched : ❌ No...

CVE-2020-36287

CVE-2020-36287 The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions chec...

CVE-2024-7313

Shield Security Plugin Vulnerability Exploit CVE-2024-7313 Overview This repository contains a Python PoC script designed to exploit a reflected XSS vulnerability in the Shield Security Plugin for WordPress, affecting versions below 20.0.6. The vulnerability CVE-2024-7313 allows an attacker to...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...

CVE-2024-4875

CVE-2024-4875 HT Mega – Absolute Addons For Elementor = 2.5.2 - Missing Authorization to Options Update Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the...

CVE-2024-45590-PoC

CVE-2024-45590 - WordPress Plugin RCE PoC Vulnerability Details - CVE: CVE-2024-45590 - CVSS: 9.8 Critical - Type: Unauthenticated RCE via Arbitrary File Upload - Affected: WordPress Plugin Proof of Concept Demonstrates safe RCE exploitation with two commands: 1. id - Command execution proof 2...