CVE-2023-6360

CVE-2023-6360 Analysis Report Overview CVE-2023-6360 is an SQL injection vulnerability found in a specific WordPress plugin, allowing an attacker to exploit security weaknesses in the web application to inject malicious SQL code into the database. This can lead to serious security issues such as...

DNN_CVE-2015-2794

DNNCVE-2015-2794 NSE plugin for Nmap that scans a DotNetNuke DNN web application for an Administration Authentication Bypass vulnerability CVE-2015-2794, EDB-ID: 39777...

CLEANSTART-2026-WV46306 Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)

Security vulnerability affects the grafana package. Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome...

CLEANSTART-2026-MO80037 built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability

Security vulnerability affects the grafana package. The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability...

CVE-2024-55980

CVE-2024-55980 Wr Age Verification = 2.0.0 - Unauthenticated SQL Injection Description The Wr Age Verification plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

WordPress Masteriyo - LMS plugin = 3.4.3 - Arbitrary Content Deletion vulnerability discovered by Sakri Koskimies Saggre in WordPress Plugin Masteriyo - LMS versions = 3.4.3...

PoC_CVE-2024-28157

PoC CVE-2024-28157 Overview Jenkins GitBucket Plugin veersion 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs. Exploitation Steps Setup Jenkins using docker: 1. Use docker...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Unauthenticated SQLi The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks setup script: 1. git clone...

WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by sanghyeok Kim Hamoyeah in WordPress Plugin Widget Options versions = 4.2.5...

WordPress Enable Media Replace plugin 4.1.4-4.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Enable Media Replace versions 4.1.4-4.2.2...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin All In One Login versions = 2.4.1...

CVE-2025-1562

CVE-2025-1562 POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124 Safari/537.36...

WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal plugin < 2.191 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Karthik in WordPress Plugin Security & Malware scan by CleanTalk versions 2.191...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

CVE-2020-35667-PoC

CVE-2020-35667-PoC Overview DISCLAIMER The vulnerable behaviour illustrated below was verified empirically from decompiled, patched artifacts, which tries to resemble the original vulnerability inferred with an heuristic approach, since the original vulnerable plugin release is no longer availabl...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Pablo Alaniz in WordPress Plugin GiveWP versions = 4.19.0.1...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ...