0x00sec_code

Código fuente de las publicaciones en 0x00sec.org Este repositorio contiene el código fuente de mis publicaciones en 0x00sec.org. Shell Remota Publicación disponible en: Parte I : https://0x00sec.org/t/remote-shells-part-i/269/1 Parte II. Crypt your link:...

CVE-2025-11926

CVE-2025-11926 Wordpress-Related-Posts-Lite-plugin-XSS-PoC para PoC: https://github.com/prabhatverma47/Wordpress-Related-Posts-Lite-plugin-XSS-PoC...

awesome-list

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2025-54352

CVE-2025-54352 PoC Uso Pasos para instalar y probar el PoC de WordPress: 1. Instala una versión nueva de WordPress usando Docker: 1.1 Inicia el contenedor de la base de datos MySQL: root@kitploit: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e...

CVE-2025-32579

⚠️ CVE-2025-32579 - RCE crítico a través del plugin Sync Posts WordPress 📦 Afecta: Sync Posts 🧨 Puntuación CVSS: 9.9 CRÍTICA 📁 Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Resumen de la vulnerabilidad El plugin Sync Posts de WordPress, creado por SoftClever Limited, es vulnerable a...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Inyección de Objetos PHP no Autenticada Descripción El plugin My Geo Posts Free para WordPress es vulnerable a Inyección de Objetos PHP en versiones hasta, e incluyendo, 1.2 mediante la deserialización de entrada no confiable. Esto hace posible que atacant...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e Este módulo requiere Metasploit: https://metasploit.com/download Código fuente actual: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q Este exploit requiere que Metasploit tenga un FQD...

CVE-2026-54047

creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...

CVE-2026-89086

creationtimestamp| type| source ---|---|--- 2026-09-10 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24 2026-09-10 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522 2026-09-10 22:20:04+00:00| seen|...

CVE-2026-68488

creationtimestamp| type| source ---|---|--- 2026-09-10 17:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6luqxvi325 2026-09-10 18:09:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nj22xqz2g 2026-09-13 05:30:26+00:00| seen|...

CVE-2026-81046

creationtimestamp| type| source ---|---|--- 2026-09-10 17:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fgcb3jfvphwvh 2026-09-10 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6lcr6a442f 2026-09-10 18:08:02+00:00| seen|...

CVE-2026-88899

creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k6ywae72y 2026-09-10 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhwumim2j...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

CVE-2026-84222 affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5 . The plugin fails to verify whether the requester is authorized to read a post before rendering and returning its content via the kirki_data parameter. This allows unauthenticated users to retrieve the content of non-...