502 matches found
WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...
CVE-2019-9787
CVE-2019-9787 CSRF PoC 概要 CVE-2019-9787 CSRF の PoC WordPress バージョン 5.1.1 CVE-2019-9787 これはテスト目的以外では使用しないでください。 インストール root@kitploit: docker-compose up -d 攻撃 1. http://localhost:8080/wp-admin/install.php にアクセスし、WordPress をインストールします。WP 管理者アカウントを作成するだけで構いません。 2. 訪問者として...
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC 概要 CVE-2019-9787 CSRF の PoC WordPress バージョン 5.0 参照 テスト目的以外では使用しないでください。 インストール root@kitploit: $ docker-compose up -d 1. http://localhost:8080/ にアクセスし、WordPress をインストールします。WP 管理者アカウントを作成するだけで構いません。 2. ビジターとして http://localhost:8080/?p=1comments にアクセスし、「csrf site:...
CVE-2026-90545
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...
CVE-2021-41349
Microsoft Exchange Exploit CVE-2021-41349 悪用対象: CVE-2021-41349 この悪用ツールは、対象のExchangeサーバーにXSSペイロードをPOSTするためのフォームを作成します。 実行したい内容を含むjsファイルを作成する必要があります。 使用方法 1. jsペイロードを作成し、どこかにアップロードします。 2. 以下の手順に従ってCVE-2021-41349.pyを実行します。 root@kitploit: python3 CVE-2021-41349.py "https://mail.target.com"...
EUVD-2026-59364
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...
MAL-2026-12113 Malicious code in python-bitcoinlib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...
EUVD-2026-52966
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-52370
Summary: CVE-2026-52370 is a reflected XSS in the Forum posting function of O2OA v10. The vulnerability allows an attacker to cause the execution of arbitrary JavaScript in a victim’s browser by visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network ac...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-47689
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...
MAL-2026-10716 Malicious code in @hibachi-xyz/ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...
CVE-2026-13042
creationtimestamp| type| source ---|---|--- 2026-07-16 06:01:11+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqqkpezfvi2y...
GHSA-465G-4Q99-5X86 NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...
PYSEC-2026-2527 Isso affected by Stored XSS via comment website field
Impact This is a stored Cross-Site Scripting XSS vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href...
CVE-2026-12406
The CVE concerns the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration” (WPUF). All versions up to 4.3.7 are affected by an authorization bypass that allows unauthenticated attackers to delete arbitrary media attachments with pos...
Malicious code in @wagni_bot/solana-sdk (npm)
The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...
CVE-2026-24249
creationtimestamp| type| source ---|---|--- 2026-07-01 16:40:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplxhlf3fn27 2026-07-02 04:35:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7f2xoll2b...