CVE-2021-22911

CVE-2021-22911 Rocket Chat 3.12.1 中的预认证盲注 NoSQL 注入导致远程代码执行 getPasswordPolicy 方法存在 NoSQL 注入漏洞，且无需认证/授权。攻击者可利用此漏洞泄露密码重置令牌，从而接管账户。接管管理员账户后可导致远程代码执行。 说明 1. 劫持用户账户（未认证） getPasswordPolicy 端点的密码重置 token 参数存在 NoSQL 注入，该参数接受 JSON 对象，允许使用 $regex 操作符。我们利用此漏洞执行盲注 NoSQL 注入以获取重置令牌。 2. 特权提升至管理员（已认证） 管理员账户很可能受 2...

chusa

chusa: 注射 Chusa - 注射 es una herramienta de pruebas de penetración de código abierto basada en SQLmap que automatiza el proceso de detección y explotación de fallos de inyección SQL y la toma de control de servidores de bases de datos. Viene con un potente motor de detección, muchas funciones...

wordpress-CVE-2024-10924--exploit

🚀 Vulnerabilidad del Plugin Really Simple Security de WordPress CVE-2024-10924 📌 Resumen WordPress es uno de los sistemas de gestión de contenidos CMS de código abierto más populares, que impulsa millones de sitios web en todo el mundo, desde blogs personales hasta plataformas de comercio...

CVE-2024-50488

CVE-2024-50488 Token Login history.pushState'', '', '/'; document.forms0.submit; 响应 root@kitploit: "status":"success","message":"Successfully regenerated token!","tokenurl":"http://kubernetes.docker.internal?token=1c8dc9406bc444d1f5cea37fae130f92"...

cve-2026-71362-magento-lab

CVE-2026-71362 — Laboratorio de cambio de identidad en la sesión de cliente de Magento / Adobe Commerce Un laboratorio Docker autocontenido y de un solo comando que reproduce CVE-2026-71362 de principio a fin y te permite verificar la corrección de Adobe, para que defensores, investigadores y...

CVE-2025-4796

CVE-2025-4796 Eventin 一旦电子邮件被更改为攻击者控制的地址，即可利用标准的 WordPress 密码重置流程接管该帐户。 🧰 脚本（PoC） 文件名：CVE-2025-4796.py 此脚本自动执行以下步骤： 1. 使用提供的凭据登录目标 WordPress 站点。 2. 提取所需的 X-WP-Nonce 3. 向 /wp-json/eventin/v2/speakers/ 发送 PUT 请求以更新演讲者的电子邮件。 4. 打印并格式化 JSON 响应及一条专业的成功消息。 环境要求： Python 3.8+ requests 安装： root@kitploit:...

CVE-2022-1162

CVE-2022-1162 在 GitLab CE/EE 14.7 至 14.7.7 之前、14.8 至 14.8.5 之前以及 14.9 至 14.9.2 之前的版本中，使用 OmniAuth 提供商（例如 OAuth、LDAP、SAML）注册的账户被设置了硬编码密码，攻击者有可能利用该密码接管账户。 漏洞利用： 新建的 GitLab 账户（自首个受影响版本以来创建，且 GitLab 版本早于已修补版本）可以使用以下密码登录： 123qweQWE!@000000000 参考： https://vulners.com/cve/CVE-2022-1162...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-72898

🔴 CVE-2026-72898 - Inyección SQL no autenticada Metabase — Inyección SQL no autenticada → Toma de control total del administrador 📌 Descripción general CVE-2026-72898 es una vulnerabilidad de severidad máxima CVSS 10.0 de inyección SQL no autenticada en Metabase que permite a un atacante remoto...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CVE-2021-24647

CVE-2021-24647 CVE-2021-24647 Pie Register 3.7.1.6 - Inicio de sesión arbitrario no autenticado Información root@kitploit: usage: exploit.py -h -w URL -p PATH options: -h, --help show this help message and exit -w URL, --url URL URL of the WordPress site -p PATH, --path PATH Path of the Login Pag...

cve-2026-9558-poc

CVE-2026-9558 — Mautic 主题模板服务端模板注入（SSTI）导致完全管理员接管 目录 概述 受影响版本 根本原因 分析 仓库结构 环境要求 使用方法 预期输出 参考 免责声明 概述 CVE-2026-9558 是 Mautic 主题引擎中的一个服务端模板注入（SSTI）漏洞。通过主题管理器上传的主题是包含 Twig 模板的 ZIP 压缩包，在受影响版本中，这些模板由应用程序默认的 Twig Environment 渲染，且未附加任何 SandboxExtension 策略。 由于 Twig 可以通过 map、filter 和 reduce 等过滤器调用任意 PHP...

CVE-2026-92421

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions 1.1.0 through

CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

CVE-2026-86591

The Botiga Pro WordPress plugin before 1.6.5 is missing authorization checks on its Templates Builder REST route , allowing unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and a full site takeover . The same route also permi...

EUVD-2026-83506

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 fails to verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account. This allows unauthenticated attackers to take over any user account—including administrators—by asserting a victim's ...

CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

EUVD-2026-83505

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...