Lucene search
+L

568 matches found

Kitploit
Kitploit
added 2026/09/07 12:36 p.m.5 views

CVE-2025-2011

CVE-2025-2011 - Depicter 插件 SQL 注入漏洞 CVE 参考: CVE-2025-2011 本仓库包含一个用于测试 Depicter Slider & Popup Builder 插件(版本 3.6.2)中 SQL 注入漏洞的概念验证环境。 前提条件 Docker Docker Compose Python 3.x 所需 Python 包:requests、colorama 搭建说明 1. 启动环境 root@kitploit: docker-compose up -d 2. 完成 WordPress 安装 打开浏览器并访问...

7.5CVSS8.2AI score0.46373EPSS
SaveExploits6
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.52 views

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

7.5CVSS7.8AI score0.46373EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.23 views

WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks. id: CVE-2023-6000 info: name: WordPress Popup Builder = 4.2.3 - Unauthenticated Stored XSS author: riteshs4...

6.1CVSS7.1AI score0.01999EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.122 views

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized 'sgpbtype' parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control 'sgpbtype' parameter. id:...

8.8CVSS7.9AI score0.05229EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.56 views

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

9.8CVSS6.4AI score0.52266EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.68 views

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

9.8CVSS8AI score0.43807EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.53 views

Popup Builder < 4.0.7 - SQL Injection

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection. id: CVE-2022-0228 info: name: Popup Builder 4.0.7 -...

7.2CVSS7.2AI score0.05887EPSS
SaveExploits2References4
Kitploit
Kitploit
added 2026/09/06 2:41 p.m.4 views

CVE-2023-6000-POC

概述 CVE-ID : CVE-2023-6000 CVSS 评分 : 6.1 类型 : 存储型 XSS 修复版本 : Popup Builder 4.2.3 此漏洞允许攻击者利用 WordPress Popup Builder 插件中的跨站脚本(XSS)缺陷。 该插件未能阻止普通用户修改现有弹窗,攻击者可通过向服务器发送特制请求,在弹窗中注入恶意脚本,当用户与弹窗交互时脚本即执行。 对于本 POC,漏洞将通过操控弹窗打开行为触发,注入一个简单的 alert 脚本,在弹窗打开时运行。 此类攻击可导致一系列问题,包括未经授权访问敏感信息以及对受影响网站的进一步利用,可能危及用户数据或整个网...

6.1CVSS7.3AI score0.01999EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/05 1:56 p.m.7 views

CVE-2024-52382

CVE-2024-52382 Matix Popup Builder = 1.0.0 - 未認証の任意オプション更新 説明 WordPress用プラグインMatix Popup...

9.8CVSS8.2AI score0.00983EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 10:26 p.m.8 views

CVE-2023-6000

CVE-2023-6000 PoC 这种检测方法是如何工作的? 此模板会查看以下路径:/wp-content/plugins/popup-builder/readme.txt 根据列出的 Stable Tag,如果版本早于 4.2.3,则视为存在漏洞。 如何运行此脚本? 1. 从此处下载 Nuclei 2. 将模板复制到你的本地系统 3. 运行以下命令:nuclei -u https://yourHost.com -t template.yaml 参考资料 https://nvd.nist.gov/vuln/detail/CVE-2023-6000...

6.1CVSS7.2AI score0.01999EPSS
SaveExploits4References2
Vulnrichment
Vulnrichment
added 2026/09/02 2:16 p.m.11 views

CVE-2026-81571 Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

4.8CVSS5.9AI score0.00154EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/02 11:59 a.m.6 views

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - 認証なし任意ショートコード実行(wpajaxnoprivshortcodeApiAdd 経由) 説明 WordPress用プラグイン「WP Popup Builder – Popup Forms and Marketing Lead Generation」は、バージョン1.3.5以前のすべてのバージョンにおいて、wpajaxnoprivshortcodeApiAdd...

9.8CVSS6AI score0.52266EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/01 10:02 p.m.5 views

cve-2020-9006

CVE-2020-9006:Wordpress Popup-Builder 插件漏洞利用 用法: root@kitploit: Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script ./cve-2020-9006 --script-args...

9.8CVSS8.2AI score0.0856EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/01 8:12 p.m.5 views

CVE-2025-2011

PoC de CVE-2025-2011 Por: X3RX3S Pero orgullosamente saqueado por Ash Wesker que usó GPT con mi código y su banner ; ver aquí --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 Incluso puedes ver mi handle en 'su' código --' Propósito: Una herramienta de prueba de concepto para evaluar una...

7.5CVSS8.2AI score0.46373EPSS
SaveExploits6References2
NVD
NVD
added 2026/08/23 6:17 a.m.14 views

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

4.3CVSS0.00165EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/23 6:17 a.m.14 views

CVE-2026-77115

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

7.1CVSS0.00146EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/23 6:00 a.m.12 views

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

4.3CVSS5.4AI score0.00165EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/23 6:00 a.m.37 views

CVE-2026-77115

Brave Popup Builder (WordPress plugin) versions up to 0.8.5 are affected by an unauthenticated reflected XSS vulnerability. The root cause is the reflection of UTM query parameters into popup form HTML without proper output escaping, allowing an attacker to inject arbitrary script via crafted URL...

7.1CVSS5.3AI score0.00146EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/23 6:00 a.m.14 views

EUVD-2026-64638

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

7.1CVSS5.3AI score0.00146EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/23 6:00 a.m.33 views

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

4.3CVSS5.4AI score0.00165EPSS
SaveExploits0References1
Rows per page
Query Builder