struts2-rce

Demonstração de Exploit para CVE-2017-5638 Completamente baseado em https://github.com/piesecurity/apache-struts2-CVE-2017-5638 Uso: Pré-requisitos: ter python, docker, maven e um jdk instalados 1. clone este repositório 2. execute mvn clean package na raiz do projeto 3. execute docker build -t...

St2-052

Teste de POC do S2-052 nome original: Implantação do war no Tomcat Endereço do artigo original: http://blog.csdn.net/caiqiiqi/article/details/77861477 Baixe a última versão afetada do site oficial do Struts2, struts-2.5.12, neste endereço:...

CVE-2017-9805

Testar nuclei CVE-2017-9805.yaml - struts2 showcase RCE Construir Dockerfile docker build -t cve-2017-9805 . Iniciar e desanexar o contêiner docker run --name cve-2017-9805 -p 127.0.0.1:8080:8080 -dit cve-2017-9805 /bin/bash Fazer login no contêiner em execução docker exec -it cve-2017-9805...

apache-struts2-CVE-2017-5638

apache-struts2-CVE-2017-5638 Aplicação de Demonstração e Exploit Exemplo de Aplicação Apache Struts2 Struts2-showcase: https://mvnrepository.com/artifact/org.apache.struts/struts2-showcase/2.3.12 Referência de Exploit: https://github.com/rapid7/metasploit-framework/issues/8064...

log4j-2021-vulnerability-study

log4j-2021-vulnerability-study هذا عرض توضيحي لكيفية استكشاف ثغرة Log4J CVE-2021-44228. هذا الكود آمن للتشغيل، لكن افهم ما يفعله وكيف يعمل!...

domato

Domato 🍅 A DOM fuzzer Written and maintained by Ivan Fratric, [email protected] Copyright 2017 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License ...

st2-048

ثغرة تنفيذ الأوامر عن بُعد St2-048 إمكانية تنفيذ RCE في Apache Struts 2 في تطبيق Struts Showcase في مثال المكوّن الإضافي Struts 1 في سلسلة Struts 2.3.x http://struts.apache.org/docs/s2-048.html https://cwiki.apache.org/confluence/display/WW/S2-048 الاستخدام: root@kitploit: python St2-048.py set u...

CVE-2026-15790

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

CVE-2026-15790

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

CVE-2026-15790 Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

EUVD-2026-59894

The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emdmbmeta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field:...

CVE-2026-15790

CVE-2026-15790 affects the Youtube Showcase plugin for WordPress. It is vulnerable to a Stored Cross-Site Scripting (XSS) in versions up to and including 4.0.4 via the 'emd_mb_meta' shortcode. The root cause is insufficient input sanitization and output escaping on attachment titles referenced by...

CVE-2026-15739

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-48527

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-15739 Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Exploit for CVE-2026-64600

cve-id Donate Support the maintenance of this project wit...

CVE-2026-12923

The Youtube Showcase plugin for WordPress (up to version 4.0.3) is vulnerable to an Arbitrary Function Call via the 'path' parameter in the emd_delete_file() AJAX handler (includes/common-functions.php). A user-supplied value is sanitized, has its trailing '_PLUGIN_DIR' stripped, and is then invo...

CVE-2026-12923

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emddeletefile AJAX handler in includes/common-functions.php. The user-supplied value is passed through...

CVE-2026-12923 Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emddeletefile AJAX handler in includes/common-functions.php. The user-supplied value is passed through...

CVE-2023-40200

Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6...