Lucene search
+L

338 matches found

Kitploit
Kitploit
added 2026/09/13 6:02 p.m.7 views

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 Escalada de Privilegios en WooCommerce ║ ║ Asignación de Rol de Administrador no Autenticada a través del Formulario de Registro CANAL DE HERRAMIENTAS Y EXPLOITS PRIV8: https://t.me/+zuUQbKSrHgwyZmI0...

9.8CVSS5.8AI score0.00437EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 5:41 p.m.8 views

CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

5.4CVSS6AI score0.00546EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 4:18 p.m.5 views

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 攻击者向 wpajaxnoprivwcfmajaxcontroller AJAX 动作发送特制请求,以修改会员注册表单并将注册角色设置为管理员。然后,插件处理该请求并修改会员注册表单,允许用户以管理员角色进行注册。 攻击者可以通过提交修改后的会员注册表单,以管理员角色注册为新用户。...

9.8CVSS8.2AI score0.02099EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/09/11 2:10 p.m.6 views

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

7.2CVSS0.00257EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
added 2026/09/10 11:32 a.m.8 views

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...

9.8CVSS6AI score0.00732EPSS
SaveExploits1
NVD
NVD
added 2026/09/10 7:17 a.m.5 views

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

7.2CVSS0.00257EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/10 6:00 a.m.8 views

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

7.2CVSS0.00257EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/10 6:00 a.m.8 views

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

0.00257EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/10 6:00 a.m.35 views

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

0.00257EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/10 6:00 a.m.22 views

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin versions 1.1.0 through 1.1.2 fails to validate the tgwcfb_id parameter during registration, reading the permitted-role allow-list from an arbitrary attacker-controlled post rather than a legitimate registration form. A user with Contributor o...

7.2CVSS0.00257EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.9 views

PT-2026-89294

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

0.00257EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/08 4:54 p.m.10 views

CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

9.8CVSS8.2AI score0.04663EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/07 10:29 p.m.5 views

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Un campo oculto. Un valor modificado. Acceso completo a todo el sitio web. 🧨 ¿Qué puede hacer el atacante? 🔬 Análisis de Vulnerabilidad Ubicación de la Vulnerabilidad root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Código Vulnerable...

9.8CVSS5.8AI score0.00487EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/07 6:43 p.m.7 views

CVE-2025-2005

Exploit de Subida Arbitraria de Archivos en WordPress FEUP CVE-2025-2005 Este repositorio proporciona un exploit de Prueba de Concepto PoC para el plugin Front End Users de WordPress versiones hasta 3.2.32, el cual es vulnerable a subida arbitraria de archivos debido a la falta de validación de...

9.8CVSS8.2AI score0.21975EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/07 2:09 p.m.5 views

CVE-2025-6934

🛡️ CVE-2025-6934 - Escalada de Privilegios no Autenticada en Opal Estate Pro 📝 Descripción El plugin Opal Estate Pro – Property Management and Submission para WordPress, utilizado por el FullHouse - Real Estate Responsive WordPress Theme , es vulnerable a Escalada de Privilegios en todas las...

9.8CVSS6AI score0.26442EPSS
SaveExploits12
EUVD
EUVD
added 2026/09/06 6:00 a.m.5 views

EUVD-2026-72066

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

5.3CVSS5.8AI score0.00182EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/22 6:00 a.m.50 views

CVE-2026-19222

CVE-2026-19222 is an authenticated privilege escalation vulnerability in the Forminator Forms WordPress plugin, affecting versions prior to 1.57.0.7 . The plugin does not consistently enforce the role restriction it applies to registration forms. A user who is permitted to build forms can configu...

6.6CVSS5.4AI score0.0026EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/22 6:00 a.m.38 views

CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

0.0026EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/22 6:00 a.m.9 views

CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

5.2AI score0.0026EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/20 2:17 p.m.12 views

CVE-2026-64970

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...

5.1CVSS0.00336EPSS
SaveExploits0References2
Rows per page
Query Builder