CVE-2024-3495-POC

CVE-2024-3495-POC The Country State City Dropdown CF7 WordPress plugin versions up to 2.7.2 is vulnerable to SQL Injection via 'cnt' and 'sid' parameters. Insufficient escaping and lack of preparation in the SQL query allow unauthenticated attackers to append queries, potentially extracting...

CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

CVE-2024-12157

CVE-2024-12157 Popup – MailChimp, GetResponse and ActiveCampaign Intergrations = 3.2.6 - Unauthenticated SQL Injection Description The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2024-55972

CVE-2024-55972 eTemplates = 0.2.1 - Unauthenticated SQL Injection Description The eTemplates plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

Cheshire

Cheshire Pre-flight payload QA for Adaptix, powered by LitterBox. Cheshire is an Adaptix C2 service plugin that bridges the Adaptix client to a LitterBox sandbox. From inside the Adaptix UI, an operator can pick any binary, dispatch it through LitterBox's full analyzer chain static + dynamic +...

0-click-RCE-Exploit-for-CVE-2024-50526

CVE-2024-50526 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859403137435459727 This repository contains a proof-of-concept exploit for CVE-2024-50526, an unauthenticated arbitrary file upload vulnerability in the Multi Purpose Mail Form WordPress plugin,...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3...

CVE-2015-3337

CVE-2015-3337 CVE-2015-3337 Arbitrary File Read http://10.10.20.166:9200/plugin/head/../../../../../../../../../etc/passwd Usage: python CVE-2015-3337.py python CVE-2015-3337.py / \ | | | | / | |/ | | | | || || || / | / / | | | | ' / /'| |/' || | | \ / / / / / / / / | | | | | | || / / | /| | | |...

CVE-2024-2473

CVE-2024-2473 — WPS Hide Login Page Identifier A professional Python scanner to detect Login Page Disclosure in WordPress sites running WPS Hide Login ≤ 1.9.15.2 Coded byVenexy Table of Contents Overview Vulnerability Details How It Works Requirements Installation Usage Output Example Disclaimer...

CVE-2021-21972

CVE-2021-21972 Description The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts...

CVE-2024-12471

CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator input type="hidden" name="insertprompt...

CVE-2023-22515_RCE

A way to achieve RCE after obtaining backend permissions in Confluence Manual GetShell Steps You can upload custom plugins in the backend to achieve RCE Access plugins/servlet/com.jsos.shell/ShellServlet...

CVE-2024-10673

🔥 Overview This script exploits CVE-2024-10673 , a critical vulnerability found in the Top Store WordPress Theme = 1.5.4. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. ⚠️ Severity & Impact...

CLEANSTART-2026-YW36992 Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers

CVE-2023-2728 affects multiple packages. Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. See references for individual vulnerability details...

CVE-2024-27198-POC

CVE-2024-27198 – JetBrains TeamCity Authentication Bypass & RCE PoC Author: EynaExp Scope: Research / Defensive Validation / Authorized Testing Only Overview This repository contains a proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198 , an...

CLEANSTART-2025-GV56895 Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2

Security vulnerability affects the postgresql15 package. The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘questionid’ parameter in versions up to, and including, 2...

hdwebmobile-photo-video-reviews

HDWebmobile Photo & Video Reviews A WooCommerce plugin that lets customers attach photos and short videos to their product reviews, shown right in the review list on the product page. WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ pending first submission Requires:...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...