CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-81742

CVE-2026-81742 affects the BE REST Endpoints WordPress plugin through version 1.0.0 . The plugin's REST endpoints handle widget read, create, update, and delete operations without performing authorization checks and without sanitizing the values it stores. This allows unauthenticated attackers to...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 fails to prevent a temporary user from creating an Application Password and does not revoke one when the temporary access expires or is disabled. As a result, the recipient of a temporary login retains working access to the site o...

CVE-2022-1388

CVE-2022-1388 - Omisión de autenticación y RCE en iControl REST de F5 BIG-IP Este script de Python explota CVE-2022-1388, una vulnerabilidad crítica en F5 BIG-IP iControl REST que permite la ejecución remota de comandos sin autenticación mediante un control de acceso inadecuado y un manejo...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Escáner de Autorización Faltante de Slider Revolution Escáner masivo profesional para CVE-2024-34444 que afecta al plugin de WordPress Slider Revolution 6.7.0 Banner 🎯 Descripción CVE-2024-34444 es una vulnerabilidad de Autorización Faltante en el plugin de WordPress Slider...

CVE-2023-35085-POC-EXP

PS: Todos los scripts están hechos por Gemini 2.5 pro y CLaude 3.7. Puede que no funcionen bien, porque yo no sé cómo usar la API "/mifs/rest/api/v2/command/exec", al igual que las IAs, que fingían que lo sabían muy bien...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector y PoC de Validación Cobertura de CVEs: CVE-2026-63030 y CVE-2026-60137 Uso previsto: Pruebas de seguridad autorizadas, validación defensiva y laboratorios locales desechables únicamente WP2Shell es una cadena de vulnerabilidades del núcleo de WordPress que combina un error de...

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Laboratorio de Deserialización Insegura en Java Aplicación Java REST básica vulnerable a Deserialización Insegura, que conduce a RCE. El proyecto debe ejecutarse en Java 8u45 Basado en Maven con las siguientes dependencias: jackson-databind 2.2.2 commons-collections 3.1...

CVE-2022-1388

CVE-2022-1388 Vulnerabilidad de omisión de autenticación REST de F5 BIG-IP iControl Argumentos opcionales: -h, --help muestra este mensaje de ayuda y sale -u url, --url url URL objetivo ej:"http://127.0.0.1" -f file, --file file Objetivos en archivo ej:"ip.txt" Uso python3 CVE-2022-1388.py -u...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 Bypass de Autenticación RCE en iControl REST de F5 BIG-IP. root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server...

CVE-2021-22986

Impacto de la Vulnerabilidad Esta vulnerabilidad permite a atacantes no autenticados con acceso de red a la interfaz REST de iControl, a través de la interfaz de gestión de BIG-IP y las direcciones IP propias, ejecutar comandos arbitrarios del sistema, crear o eliminar archivos y deshabilitar...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...

CVE-2026-68535

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-81908

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

CVE-2026-18122

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

WP2Shell

WP2Shell - Exploit de RCE Pre-Auth de WordPress CVE-2026-63030 + CVE-2026-60137 Versión: 4.0.0 Autor: G0D150NE 📌 Descripción general WP2Shell es una herramienta de explotación de cadena completa para la ejecución remota de código pre-autenticación en WordPress. Combina dos vulnerabilidades...

CVE-2026-18122

Concrete CMS versions 9.2.0 through 9.5.2 contain a Missing Authorization flaw in the Express REST API list endpoint . The Express entry collection endpoint disabled the per-entry view permission check, allowing an OAuth token with read scope for an Express entity to enumerate entries the user co...