CVE-2019-9787

CVE-2019-9787 CSRF PoC 개요 CVE-2019-9787 CSRF의 PoC WordPress 버전 5.1.1 CVE-2019-9787 테스트 목적 외에는 사용하지 마십시오. 설치 root@kitploit: docker-compose up -d 공격 1. http://localhost:8080/wp-admin/install.php에 접속하여 WordPress를 설치하세요. WP 관리자 계정만 생성하면 됩니다. 2. 방문자로 http://localhost:8080/?p=1comments에 접속한 뒤 "Hacker...

cve-2019-9787_csrf_poc

CVE-2019-9787 CSRF PoC Aperçu PoC de la vulnérabilité CSRF CVE-2019-9787 WordPress version 5.0 référence N'utilisez ceci qu'à des fins de test. Installation root@kitploit: $ docker-compose up -d 1. accédez à http://localhost:8080/ et installez WordPress. Vous devez seulement créer un compte...

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...

EUVD-2026-59364

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

MAL-2026-12113 Malicious code in python-bitcoinlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...

EUVD-2026-52966

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-52370

Summary: CVE-2026-52370 is a reflected XSS in the Forum posting function of O2OA v10. The vulnerability allows an attacker to cause the execution of arbitrary JavaScript in a victim’s browser by visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network ac...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-47689

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

MAL-2026-10716 Malicious code in @hibachi-xyz/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308aa7f8a3746a346bbed305975f68d110bcf6b98815b7bf9f579e37089fd78b The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.js, executed on require,...

CVE-2026-13042

creationtimestamp| type| source ---|---|--- 2026-07-16 06:01:11+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqqkpezfvi2y...

GHSA-465G-4Q99-5X86 NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

PYSEC-2026-2527 Isso affected by Stored XSS via comment website field

Impact This is a stored Cross-Site Scripting XSS vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href...

CVE-2026-12406

The CVE concerns the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration” (WPUF). All versions up to 4.3.7 are affected by an authorization bypass that allows unauthenticated attackers to delete arbitrary media attachments with pos...

Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2026-24249

creationtimestamp| type| source ---|---|--- 2026-07-01 16:40:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplxhlf3fn27 2026-07-02 04:35:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7f2xoll2b...

CVE-2026-54814

creationtimestamp| type| source ---|---|--- 2026-06-29 20:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphckhdxdj26...

CVE-2026-57589

creationtimestamp| type| source ---|---|--- 2026-06-25 02:29:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3f447rn42l 2026-07-08 01:10:04+00:00| seen| https://bsky.app/profile/lobsters-feed.bsky.social/post/3mq3wpi5hat2y 2026-07-08 10:01:20+00:00| seen|...

MAL-2026-6404 Malicious code in syco1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43be65a0930b121cf4d610c70b2d07165e4d335dece4344590b471d078fa5b5 Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay. pointer.py captures...