CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

CVE-2023-43284

CVE-2023-43284 DLink Modell DIR-846 Authentifizierte Remote-Code-Ausführung. Diese Schwachstelle missbraucht den QoS-POST-Parameter im Router, um eine authentifizierte Remote-Code-Ausführung auszunutzen. Erfordert nicht, dass QoS aktiviert ist! root@kitploit: -h, --help show this help message and...

CVE-2023-31717

CVE-2023-31717 È possibile effettuare un'iniezione SQL nel parametro id della richiesta HTTP POST passato nel corpo come json, riuscendo a estrarre informazioni riservate dal database SQLite Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AN...

cve-2018-1273

CVE-2018-1273 Spring Data Commons RCE vulnerabilità di esecuzione remota di comandi uso root@kitploit: C:\Users\CTF\Desktoppython cve-2018-1273.py / / | / / /| |/ : touch /tmp/jas502n 405, May Have a CVE-2018-1273 vulnerability! CVE-2018-1273 Vulnerability Exit! Cmd : Richiesta BurpSuite:...

CVE-2023-34835

CVE-2023-34835 — Console di Gestione eScan: Cross-Site Scripting Riflesso XSS Indice Panoramica Dettagli della Vulnerabilità Prodotto Affetto Analisi Tecnica Prova di Concetto Passi per Riprodurre Impatto Mitigazione e Rimedio Riferimenti Disclaimer Panoramica Una vulnerabilità di Cross-Site...

CVE-2026-2058-PoC

CVE-2026-2058-PoC – Injeção SQL no Projeto PHP CloudClassroom Visão Geral Existe uma vulnerabilidade de Injeção SQL na funcionalidade Post Query do Projeto PHP CloudClassroom v1.0. A vulnerabilidade permite que atacantes injetem comandos SQL arbitrários por meio do parâmetro POSTsqueryx, levando ...

CVE-2019-20197

Уязвимость удаленного выполнения команд в Nagios XI CVE-2019-20197 PoC: POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

CVE-2021-43650

CVE-2021-43650 Webrun = 3.6.0.42 SQL注入漏洞 描述 Webrun是一个基于Web的管理应用程序。在3.6.0.42版本中，发现并报告了一个SQL注入漏洞，该漏洞发生在登录过程中，具体来说，我们将在POST参数P1中注入有效载荷。 概念验证（POC） 在登录过程中，将发送以下请求： root@kitploit: POST /webrun/executeRule.do HTTP/1.1 Host: restricted Content-Length: 334 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x...

CVE-2025-5287

CVE-2025-5287 Plugin Likes and Dislikes = 1.0.0 - SQL Injection Non Autenticata Descrizione Il plugin Likes and Dislikes per WordPress è vulnerabile a SQL Injection tramite il parametro 'post' in tutte le versioni fino alla 1.0.0 inclusa, a causa di un escaping insufficiente sul parametro fornito...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-75908

The Newsletters plugin for WordPress (all versions up to and including 4.17 ) is susceptible to an authorization bypass due to missing verification of user permissions. An authenticated attacker with author-level access or above can forge the newsletters_mailinglistsroles POST field during a norm...

CVE-2020-17496

CVE-2020-17496 root@kitploit: POST /ajax/render/widgettabbedcontainertabpanel?XDEBUGSESSIONSTART=phpstorm HTTP/1.1 Host: localhost User-Agent: curl/7.54.0 Accept: / Content-Length: 100 Content-Type: application/x-www-form-urlencoded subWidgets0template=widgetphp&subWidgets0configcode=echo...

CVE-2025-50867

Existe uma vulnerabilidade de injeção SQL no endpoint takeassessment2.php do CloudClassroom-PHP-Project 1.0, onde o parâmetro POST Q5 é incorporado diretamente em instruções SQL sem sanitização. Tipo de Vulnerabilidade : SQL Injection Fornecedor do Produto :...

CVE-2025-5287

CVE-2025-5287 PoC Exploit di SQL Injection non autenticata per WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Descrizione Questo script Python è un proof-of-concept PoC per CVE-2025-5287 , che sfrutta una vulnerabilità nel WordPress Likes and Dislikes Plugin ≤ 1.0.0. La vulnerabilità consente ad...

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 – Nicht authentifizierte SQL-Injection Beschreibung Das Plugin „Likes and Dislikes“ für WordPress ist bis einschließlich Version 1.0.0 anfällig für SQL-Injection über den Parameter „post“. Grund dafür ist die unzureichende Maskierung des...

CVE-2026-71294

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...

CVE-2026-14767 CodeAstro Ecommerce Website POST Parameter confirm.php sql injection

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoiceno results in sql injection. The attack can be executed...

CVE-2026-14692

A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function saveshoptype of the file classes/Master.php of the component POST Parameter Handler. Performing a manipulation results in sql injection. The attack is possible to be...

EUVD-2026-41715

A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function saveshoptype of the file classes/Master.php of the component POST Parameter Handler. Performing a manipulation results in sql injection. The attack is possible to be...