sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2026-120573

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-120573

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions

EUVD-2026-124990

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-120573 WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-128033 OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in MageRssModelResourceOrder::getAllCommentCollection, which omits the isvisibleonfront filter for invoice, shipment and credit-memo comments. Authenticated customers can open...

CVE-2026-128033

The OpenMage magento-lts platform is affected by an information disclosure vulnerability in versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. The root cause is located in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() function, which fails to apply the is_visible_on_fron...

CVE-2026-128045

OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to an authorization bypass in the /rss/order/status feed. The root cause is that the feed's URL key consists of unsigned Base64-encoded JSON containing order, increment, and customer IDs. This allows ...

CVE-2023-5612

Disclosure of the public email in Tags RSS Feed https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.9.1...

ShunyaNet-Sentinel

ShunyaNet Sentinel v3.3 - MAJOR UPDATE UPDATED: 10/22/2026 ShunyaNet Sentinel is a lightweight, cyberpunk-themed program that ingests RSS feeds breaking news, social media, government alerts, sends them to an LLM for analysis, and delivers alerts and summary reports to the GUI and your notificati...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 exploit Kirby 3.9.6 XML External Entity Exploit for CVE-2023-38490 / GHSA-q386-w6fg-gmgp. Exploitation demonstration Build and run the vulnerable demo app: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

CVE-2026-116558

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/ inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-118959

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/ inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-116558 Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/ inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-116558

The Unlimited Elements for Elementor plugin for WordPress (all versions up to and including 2.0.26 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the RSS Feed catalog widget . Specifically, the plugin's escaping ...

CVE-2026-118178

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location o...

SUSE CVE-2026-118178

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make...