WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2026-97283

The Advanced Post Manager plugin for WordPress (versions ≤ 4.5.5 ) is susceptible to a PHP Object Injection vulnerability caused by the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to unauthorized actions. No specific remediation steps or...

CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

EUVD-2026-92590

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

CVE-2021-38647

CVE-2021-38647 This is a POC for CVE-2021-38647 : Send a POST request to /wsman with the content of payload.xml and only change the command with your desired one, AS POC, only id command is executed. Source: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure Follow if you like :...

DarkReplica

DarkReplica CVE-2026-23631 Redis Post-Auth RCE Exploit The full technical writeup can be found here: https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica...

Network-Filesystem-Forensics

Network and Filesystem Forensics Reports on post-exploitation on honeypot exploiting vulnerable wu-ftpd CVE-2001-0550...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2024-38856

CVE-2024-38856 Apache Ofbiz RCE Scanner Description This script is designed to scan for the CVE-2024-38856 vulnerability in Apache Ofbiz applications, which may allow for remote code execution. It sends HTTP POST requests to specific paths within the Ofbiz application with malicious payloads to...

CVE-NetScalerFileSystemCheck

CVE-NetScalerFileSystemCheck This script checks the Citrix Netscaler if it has been compromised by CVE-2019-19781 attacks and collects all file system information. The following files and logs will be checked Latest version 1.13: Template folders for XML files Apache Access logfiles Apache Error...

EUVD-2026-92488

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohamed Bassia in WordPress Plugin Advanced Posts Listing – Show Post List Easily versions = 1.0.8...

CVE-2015-1397-Magento-Shoplift

CVE-2015-1397-Magento-Shoplift Vulnerability Details Vulnerability as seen in HackTheBox - SwagShop Stage 1 = exploit.py Gain administrator credentials to Magento CMS dashboard Stage 2 = postauth.py With credentials gained from exploit.py added to postauth.py run: python3 postauth.py...

CVE-2026-88396

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...

CVE-2024-57427

CVE-2024-57427 - Reflected Cross-Site Scripting XSS PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting XSS. Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal...

CVE-2017-9841

phpunit-shell ⭐ a simple python3 script to exploit CVE-2017-9841. the exploit - CVE-2017-9841 ❗ simple script that exploits a remote code execution vulnerability found in PHPUnit before 4.8.28 and 5.x before 5.6.3. makes a post request to the target with user input system commands...

inputcontrol

inputcontrol A silly proof-of-concept application for CVE-2023-28197, as submitted to Apple when reporting. This pairs well with its respective blog post, "CVE-2023-28197: inputcontrol"...

Citrix-ADC-RCE-CVE-2020-8193

Citrix ADC RCE 0x01 CreateSession request POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: 192.168.3.18:9080 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/76.0.3809.132 Safari/537.36...