CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE 漏洞利用 严重漏洞 CVE 编号： CVE-2025-32583 严重性： 9.9（严重） CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 描述 PDF 2 Post WordPress 插件（由 termel 开发）中存在一个漏洞，由于对代码生成的掌控不当 ，导致远程代码包含（RCE） 。 受影响版本：= 2.4.0 该漏洞允许已认证用户 （即使是低权限用户）上传包含 PHP 代码的 .zip 文件。插件解压后，恶意 PHP...

CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

EUVD-2026-92961

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-75962

The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...

CVE-2019-20224

CVE-2019-20224 El exploit oficial para Pandora v7.0NG Ejecución remota de código post-autenticación CVE-2019-20224...

React2Shell

Laboratorio Docker, Escáner de Detección y Validación de PoC: React2Shell CVE-2025-55182 Aviso legal: Este repositorio y sus artefactos de PoC se crean estrictamente con fines educativos, de investigación y de demostración de seguridad defensiva dentro de un entorno de laboratorio aislado. Las...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

CVE-2025-55182-POC

CVE-2025-55182 – 命令注入漏洞扫描器 包含真实命令输出的完整概念验证 此仓库包含一个基于 Python 的概念验证 PoC 扫描器，用于 CVE-2025-55182，演示攻击者如何通过基于 JSON 的 POST 请求利用命令注入漏洞。 该工具允许安全研究人员和渗透测试人员通过发送命令并获取其执行输出来验证目标是否存在漏洞。 ⚠️ 免责声明 本项目仅用于教育、研究和授权的渗透测试目的 。 您全权负责遵守所有适用法律。 请勿将本工具用于您不拥有或未获得明确测试许可的系统。 作者对任何滥用或造成的损害不承担任何责任 。 DORK SHODAN:...

reverie

Reverie Una implementación eficiente del NIZKPoK presentado en KKW 2018 Reverie es una implementación demostrador y verificador del NIZKPoK MPC-in-the-head presentado en Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures. Reverie busca ofrecer eficiencia concreta...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-92842

vLLM: Harmony tool continuations drop cachesalt — restoring a cross-tenant prefix-cache membership oracle...

PT-2026-106717

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

PT-2026-106333

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

PT-2026-106462

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

PT-2026-107258

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

PT-2026-106755

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group documents/upload stores an attacker-controlled group document filename that group workspaces.html later interpolates into inline Share even...

PT-2026-107257

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

WP < 7.1.3 - Action Injection via Post Status Transition Dynamic Hooks

Description WordPress does not restrict some dynamically generated action hook names to registered post statuses and types during a status transition in some cases, which could allow an attacker who can introduce a post with attacker-controlled status or type through a separate vulnerability to...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...