CallStranger

CallStranger This script created by Yunus Çadırcı https://twitter.com/yunuscadirci to check against CallStranger CVE-2020-12695 vulnerability. An attacker can use this vulnerability for: Bypassing DLP for exfiltrating data Using millions of Internet-facing UPnP device as source of amplified...

hpfeeds

hpfeeds About hpfeeds is a lightweight authenticated publish-subscribe protocol. It has a simple wire-format so that everyone is able to subscribe to the feeds with their favorite language in almost no time. Different feeds are separated by channels and support arbitrary binary payloads. This mea...

WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

FluentCRM WordPress plugin = 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key. id: CVE-2026-7798 info: name:...

Subscribe to Category <= 2.7.4 - SQL Injection

The Subscribe to Category contains a sqlinjection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2023-32590 info: name: Subscribe to Category = 2.7.4 - SQL Injection author:...

miniupnpd_poc

Miniupnpd path that is greater than 526 bytes. The root cause is due to the lack of validating the return value of snprintf since snprintf returns the value of how many bytes it could of copied, not how many bytes it did copy. As of Jan-25-2019 the PoC within this repro has been successfully test...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - Unauthenticated SQL Injection Description The Subscribe to Category plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-120467

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...

EUVD-2026-124610

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...

CVE-2026-120467 Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...

CVE-2026-120467

The AcyMailing extension for Joomla and WordPress (versions 1.0.0 - 11.1.1 ) is vulnerable to an authorization bypass due to a failure to bind subscriber identities to the records being acted upon. This flaw allows an authenticated user of any privilege level to subscribe or unsubscribe any other...

PT-2026-145998

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...

CVE-2026-120467: Datasolution AcyMailing extension for Joomla and WordPress: Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing…

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...

MAL-2026-17392 Malicious code in focashi (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-118167

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...

EUVD-2026-117912

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

MAL-2026-17408 Malicious code in whalibmob (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-12343)

Summary IBM MQ has addressed a denial of service vulnerability due to improper validation of RFH2 message header fields in queued publish/subscribe operations. Vulnerability Details CVEID:CVE-2026-12343 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service due to...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-12343)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2026-12343 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service due to improper...

CVE-2026-12343

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...