6960 matches found
WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts
WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...
My Geo Posts Free <= 1.2 - PHP Object Injection
The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...
WordPress Simple Job Board - Unauthorized Data Access
The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...
YMC Filter WordPress - Unauthenticated Post Disclosure
YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
osi.ig
Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...
CVE-2025-54352
CVE-2025-54352 PoC Uso Pasos para instalar y probar el PoC de WordPress: 1. Instala una versión nueva de WordPress usando Docker: 1.1 Inicia el contenedor de la base de datos MySQL: root@kitploit: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e...
CVE-2025-32579
⚠️ CVE-2025-32579 - RCE crítico a través del plugin Sync Posts WordPress 📦 Afecta: Sync Posts 🧨 Puntuación CVSS: 9.9 CRÍTICA 📁 Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Resumen de la vulnerabilidad El plugin Sync Posts de WordPress, creado por SoftClever Limited, es vulnerable a...
awesome-list
Awesome Cybersecurity List Mi colección personal de publicaciones de blog, write-ups y papers increíbles centrados en ciberseguridad. Para profundizar en herramientas relacionadas con la ciberseguridad, consulta la lista dedicada Cybersecurity Tools. Índice 2026 2025 2024 2023 2022 2021 2020 2019...
0x00sec_code
0x00sec.org 帖子的源代码 此仓库包含我在 0x00sec.org 上帖子的源代码。 远程Shell 帖子见： 第一部分：https://0x00sec.org/t/remote-shells-part-i/269/1 第二部分. 加密你的链接：https://0x00sec.org/t/remote-shells-part-ii-crypt-your-link/306 源代码位于 remoteshell 第三部分. Shell...
CVE-2024-52433
CVE-2024-52433 My Geo Posts Free = 1.2 - 未认证的PHP对象注入 描述 WordPress 的 My Geo Posts Free 插件在版本 1.2 及以下版本中，由于对不可信输入进行反序列化，存在 PHP 对象注入漏洞。这使得未认证的攻击者能够注入一个 PHP 对象。受影响的软件中不存在已知的 POP 链。如果目标系统上安装了额外的插件或主题中存在 POP 链，则攻击者可能能够删除任意文件、获取敏感数据或执行代码。 下载链接：下载 my-geo-posts-free 版本 1.2 root@kitploit: 类型: plugin CVSS 评...
nate158g-m-w-n-l-p-d-a-o-e
nate158g-m-w-n-l-p-d-a-o-e 此模块需要 Metasploit：https://metasploit.com/download 当前来源：https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Popular Posts 插件认证远程代码执行', 'Description' = %q 此漏洞利用要求 Metasploit 拥有一个 FQDN，并且能够运行端口 80、443 或 8080 上的有效载荷 Web 服务器。 FQDN...
CVE-2026-54047
creationtimestamp| type| source ---|---|--- 2026-09-11 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb3rquccx2f 2026-09-11 18:08:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hh4d5o26wjn56 2026-09-11 18:08:41+00:00| seen|...
CVE-2026-89086
creationtimestamp| type| source ---|---|--- 2026-09-10 21:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mv6x2w74gh24 2026-09-10 22:08:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv72tzbqc522 2026-09-10 22:20:04+00:00| seen|...
CVE-2026-68488
creationtimestamp| type| source ---|---|--- 2026-09-10 17:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6luqxvi325 2026-09-10 18:09:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nj22xqz2g 2026-09-13 05:30:26+00:00| seen|...
CVE-2026-81046
creationtimestamp| type| source ---|---|--- 2026-09-10 17:28:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fgcb3jfvphwvh 2026-09-10 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6lcr6a442f 2026-09-10 18:08:02+00:00| seen|...
CVE-2026-88899
creationtimestamp| type| source ---|---|--- 2026-09-10 17:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv6k6ywae72y 2026-09-10 18:08:45+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhwumim2j...
CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
CVE-2026-84222
CVE-2026-84222 affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5 . The plugin fails to verify whether the requester is authorized to read a post before rendering and returning its content via the kirki_data parameter. This allows unauthenticated users to retrieve the content of non-...