CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2023-4281

CVE ID: CVE-2023-4281 Vulnerability Type: IP Address Spoofing Description: The Activity Log plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce: Run the...

CVE-2021-1056

CVE-2021-1056 CVE-2021-1056 is a vulnerability I submitted to NVIDIA PSIRT. Personally, it may lead to high security risks in multi-tenant HPC clusters, especially in cloud machine-learning platforms. This repository simply demonstrates the vulnerability on GPU containers created by...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro, and Pro Multisite 9.0.0 - 9.1.1.1 - Authentication Bypass 📖 Description This script exploits a vulnerability in the Really Simple Security plugin versions 9.0.0 - 9.1.1.1 for WordPress.The flaw allows authentication bypass due to improper...

opac-fast-automation

CVE-2025-65862 — Documentation, Analysis, and Automation Tool Research Purposes Only ⚠️ Ethical & Legal Warning All materials in this repository are provided solely for: security research, learning, vulnerability analysis, and testing in environments you own or have explicit permission to test...

zeek-elf

A Zeek ELF Package This package implements: ELF TLDR! If you have zkg and you have already run... zkg autoconfig ... then you can install this package as so: sudo zkg install zeek-elf Now in any Zeek script, just load the plugin and it "just works": @load Zeek/ELF New events for this plugin are...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free Unauthenticated Stored Blind XSS Executive Summary This repository contains a local Docker lab for reproducing CVE-2025-11262 , an unauthenticated stored cross-site scripting issue affecting the WordPress plugin Link Whisper Free. The lab compares two plugin...

CVE-2024-10924

Exploit for CVE-2024-10924 WordPress Really Simple Security Plugin - Authentication Bypass 📌 Overview CVE-2024-10924 is a critical authentication bypass vulnerability in the Really Simple Security plugin for WordPress versions 9.0.0 to 9.1.1.1. This vulnerability allows unauthenticated attackers ...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2016-10956-mail-masta

Mail Masta - Local File Read CVE-2016-10956 The mail-masta plugin 1.0 for WordPress has local file read in countofsend.php and csvexport.php. Usage $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h -v -s -t TARGETURL -f FILE | -F...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...

Jira-Scan

Jira-Scan ONLY TESTED WITH PYTHON 3 Provide a list of websites to test with out the http or https and this will test each one for the SSRF vun. Use a VPS from DO CVE-2017-9506 The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Docker Commons API Plugin for Jenkins API plugin, which provides the common shared functionality for various Docker-related plugins. Summary API for managing Docker image and container fingerprints Credentials and location of Docker Registry Credentials and location of Docker Daemon aka Docker...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2025-5287

Description: It is an exploit code that works for multiple urls and multi thread for Unauth Sql Injection on Wp plugin with CVE-2025-5287 Example usage: usage: CVE-2025-5287.py -h --file FILE --fudge FUDGE --timeout TIMEOUT --threads THREADS --proxy PROXY Time-Based SQLi Checker Clean, Threaded,...

PostGallery-CVE-Report

PostGallery-CVE-Report Disclosure for CVE-2025-13543 CVE-2025-13543 - Vulnerability in PostGallery This repository discloses a vulnerability discovered in PostGallery =" \ -F "action=postgalleryAjaxUpload" \ -F "postid=1" \ -F "uploadFolder=../../../" \ -F "name=shell.php" \ -F...

CVE-2024-6460

CVE--2024-6460 Grow by Tradedoubler 2.0.22 - Unauthenticated LFI Usage ausage: CVE-2024-6460.py -h -u URL -U USERNAME -P PASSWORD -c COMPONENT Grow by Tradedoubler 2.0.22 - Unauthenticated LFI options: -h, --help show this help message and exit -u URL, --url URL Target WordPress site URL e.g.,...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...