41114 matches found
CVE-2026-49772
The Events Calendar SQL Injection CVE-2026-49772 PoC Description CVE-2026-49772 is an unauthenticated blind SQL injection in the WordPress plugin The Events Calendar. A broken REST parameter validator validatecallback returns a closure instead of validating lets the order parameter on the...
CVE-2026-78006-POC
CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar = 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution CONTACT telegram for any ask : @soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20:...
hermes-the-messenger
Hermes the messenger A PoC for achieving persistence via push notifications on Windows For more technical details and background read our blogpost here: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Usage Before anything else you need to setu...
Prompt-Injection-in-the-Wild
Prompt Injection in the Wild A tracker of publicly reported prompt-injection techniques from roughly the last two years, maintained by Rachel James cybershujin. Each technique is broken down into the three elements of a prompt injection: 1. Delivery method — how the injected instructions reach th...
HTB-TwoMillion-machine
Hack The Box - TwoMillion Writeup Overview This repository contains my walkthrough for the Hack The Box - TwoMillion machine. The goal of this writeup is to document my methodology, explain the enumeration process, and demonstrate the exploitation chain that led to both User and Root access...
pth-toolkit
pth-toolkit A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems The master branch is compiled for amd64, the final goal will be to cross compile these...
CVE-2026-85046
CVE-2026-85046 Chrome Zero-Day Vulnerability Exploited in the Wild Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten...
CVE-2026-110903
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1...
CVE-2026-110903 WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1...
EUVD-2026-102864
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1...
CVE-2026-110903
The Liquid Web / StellarWP The Events Calendar WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions from n/a through 6.18.1 . An attacker could potentially execute malicious scripts in t...
WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin The Events Calendar versions = 6.18.1...
SUSE CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
GetFGPP
GetFGPP Dumps Fine Grained Password Policies FGPP from Active Directory via LDAP. Requires read access to the Password Settings Container — by default only admins have this right, but it's occasionally misconfigured. Install pip3 install ldap3 python-dateutil no longer required Usage usage: fgpp....
CVE-2026-94169
Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...
CVE-2026-15222
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...
CVE-2026-110014
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'...
CVE-2026-110015
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator in...
CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...