CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

JSONPath

개발 종속성 라이선스는 여기를 참조하세요 JSONPath Plus JSON 문서및 JavaScript 객체에서 데이터를 분석, 변환, 선택적으로 추출합니다. jsonpath-plus는 원래 사양을 확장하여 일부 추가 연산자를 제공하고, 원래 사양에서 명시하지 않은 일부 동작을 명확히 합니다. 브라우저 데모 또는 Runkit Node를 사용해 보세요. 참고: 이 프로젝트는 현재 적극적으로 유지관리되고 있지 않습니다. 잘 문서화된 PR이나 간단한 업데이트는 수락할 수 있지만, 저희가 직접 수정하거나 새로운 기능을 추가할 계획은...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 SiteLookup.do의 XSS 취약점 정보 설명: Zoho ManageEngine ServiceDesk Plus 9.3에서 문제가 발견되었습니다. SiteLookup.do의 qcsiteID 매개변수를 통해 XSS가 발생합니다. 작성자: Tarantula 팀의 Concobe - VinCSS Vingroup 소속 페이로드...

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2019-12476

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus версии 4.3.3 PoC для обхода аутентификации на Windows 10. Влияет на все версии Windows PoC Видео Шаги для воспроизведения 1. Отключитесь от корпоративной сети 2. Подключитесь к своей собственной точке доступа 3. Нажмите на сброс пароля;...

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

AJ-Report < 1.4.1 - Remote Code Execution

AJ-Report before version 1.4.1 is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java code on the victim server through script engine injection in the validation rul...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

phpMyChat-Plus 1.98 - Cross-Site Scripting

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. id: CVE-2019-19908 info: name: phpMyChat-Plus 1.98 - Cross-Site Scripting author: madrobot severity: medium description: | phpMyChat-Plus 1.98 contains a cross-site...

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-24358 info: name: Plus Addons for Elementor Page Builder 4.1.10 - Open Redirect...

ionCube Tester Plus <= 1.3 - Local File Inclusion

The ionCube Tester Plus plugin for WordPress versions = 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: ServiceDesk Plus의 SAML 로그인 중 발생하는 인증 우회 취약점입니다. ManageEngine에 설명된 대로. 대상 ServiceDesk Plus11134 설치본에서 SAML 로그인이 활성화되어 있고 낮은 권한 사용자의 자격 증명을 보유하고 있다면 관리자로 권한을 상승시켜 RCE를 획득할 수 있습니다. 이 취약점을 악용하는 데 대한 공개 익스플로잇이나 자세한 설명이 없어 이 POC를 공개하기로 결정했습니다. 코드는 다소 지저분하지만 동작합니...

CVE-2019-12189

CVE-2019-12189 - Zoho ManageEngine ServiceDesk Plus 9.3 XSS уязвимость Информация Описание: XSS была обнаружена в ManageEngine ServiceDesk Plus версии Затронутые версии: 9.3 Исследователь: Dang The Tuyen Доказательство концепции Уязвимость возникает из-за путаницы с одинарными кавычками и точкой ...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus, 부적절한 입력 검증으로 인한 원격 코드 실행RCE 취약점 개요 CVE-2024-21534는 jsonpath-plus 패키지의 10.0.0 이전 버전에서 발견된 심각한 취약점입니다. 이 취약점은 부적절한 입력 검증에서 비롯되며, 영향을 받는 시스템에서 원격 코드 실행RCE으로 이어질 수 있습니다. 이 취약점은 인증 없이도 악용될 수 있어 특히 위험하며, 공격자는 특수하게 조작된 입력을 전송하여 서버에서 임의의 코드를 실행할 수 있습니다. 이 문제는 안전하지 않은 기...