Lucene search
+L

19559 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.51 views

WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator- from n/a through 1.0.9. id: CVE-2023-47873 info: name: WordPress WP Child Theme Generator 1.1.3 - Arbitrary File Upload author: cysamu,Crux severity...

9.1CVSS7.2AI score0.02276EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.126 views

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...

9.8CVSS7.5AI score0.15647EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.31 views

WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery

The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery SSRF via the 'url' parameter in the getremotedata.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2024-4399 info: name: WordPre...

9.1CVSS5.9AI score0.01821EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.40 views

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

7.5CVSS7.2AI score0.55008EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.14 views

WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campresswoocommercegetajaxproducts' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. id: CVE-2024-10763 info: name: WordPress Campress Theme =...

9.8CVSS7.5AI score0.03655EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.19 views

WordPress Madara Theme < 2.2.2.1 - Local File Inclusion

Madara WordPress theme = 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request. id: CVE-2025-4524 info: name: WordPress Madara Theme...

9.8CVSS7.4AI score0.10373EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.81 views

JobMonster < 4.5.2.9 - Cross-Site Scripting

In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. id: CVE-2022-1170 info: name: JobMonster 4.5.2.9 - Cross-Site Scripting author: Akincibor,ritikchaddha severity: medium description: | In the theme JobMonste...

6.1CVSS6.3AI score0.01789EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.122 views

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

9.8CVSS7.4AI score0.71427EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.95 views

WordPress Page Builder KingComposer <=2.9.6 - Open Redirect

WordPress Page Builder KingComposer 2.9.6 and prior does not validate the id parameter before redirecting the user to it via the kcgetthumbn AJAX action which is available to both unauthenticated and authenticated users. id: CVE-2022-0165 info: name: WordPress Page Builder KingComposer =2.9.7 to...

6.1CVSS6.6AI score0.0428EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.157 views

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...

6.1CVSS6.3AI score0.02591EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.95 views

WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting

WordPress Laborator Neon theme 2.0 contains a cross-site scripting vulnerability via the data/autosuggest-remote.php q parameter. id: CVE-2019-20141 info: name: WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting author: knassar702 severity: medium description: WordPress Laborator Neon them...

6.1CVSS6.3AI score0.05008EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.72 views

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

9.8CVSS7.5AI score0.02303EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.101 views

PrestaShop Theme Volty CMS Blog - SQL Injection

In the module 'Theme Volty CMS Blog' tvcmsblog up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. id: CVE-2023-39650 info: name: PrestaShop Theme Volty CMS Blog - SQL Injection author: mastercho severity: critical description: | In the...

9.8CVSS7.2AI score0.04065EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/08/31 5:09 a.m.3 views

cve-2025-50946

cve-2025-50946 CVE-2025-50946(OliveTin get-theme RCE)用のエクスプロイトスクリプトです。文字の要件が非常に厳しく、複数の引数を含む多くのコマンドは正しく実行されない可能性があります。根本原因の調査やスクリプトの堅牢化にはまだ時間をかけていません。必要な場合はご連絡いただくか、PRを開いてください。 このスクリプトの基となったオリジナルの調査は chrisWalker11 によるものです: リンク 使用例 基本PoC: root@kitploit: python cve-2025-50946.py -t...

6.5CVSS7.2AI score0.013EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/08/31 1:37 a.m.4 views

abhinavagarwal07.github.io

Chirpy Starter RubyGems.org을 통해 Chirpy 테마를 설치하면, Jekyll은 테마의 gem에 있는 data, layouts, includes, sass 및 assets 폴더와 config.yml 파일의 일부 옵션만 읽을 수 있습니다. 이 테마 gem을 설치한 적이 있다면 bundle info --path jekyll-theme-chirpy 명령을 사용하여 이 파일들을 찾을 수 있습니다...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/31 1:36 a.m.6 views

cve-2026-9558-poc

CVE-2026-9558 — Внедрение шаблонов на стороне сервера SSTI в темы Mautic для полного захвата администратора Содержание Обзор Затронутые версии Коренная причина Анализ Структура репозитория Требования Использование Ожидаемый вывод Ссылки Отказ от ответственности Обзор CVE-2026-9558 — это уязвимост...

9.9CVSS5.8AI score0.00571EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/30 7:19 p.m.3 views

TryHack3M-Bricks-Heist

target:10.201.6.98 enumeration root@kitploit: nmap -A 10.201.6.98 поскольку здесь установлен WordPress с именем «brick by brick», а название этой комнаты — brick, вероятно, именно здесь можно найти уязвимость итак, давайте просканируем WordPress root@kitploit: wpscan --url https://bricks.thm...

10CVSS7.5AI score0.88234EPSS
SaveExploits19References1
Kitploit
Kitploit
added 2026/08/30 5:51 p.m.4 views

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 Herramienta de Explotación RCE de WonderCMS CVE-2023-41425 Esta herramienta ofensiva de seguridad basada en Python automatiza la explotación de una vulnerabilidad de Ejecución Remota de Código RCE en WonderCMS 4.3.2 , específicamente CVE-2023-41425. Simplifica el proceso de crear un módulo de...

6.1CVSS6.6AI score0.54026EPSS
SaveExploits16References1
Kitploit
Kitploit
added 2026/08/30 4:23 p.m.42 views

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

5.8AI score
SaveExploits0References11
Kitploit
Kitploit
added 2026/08/30 3:12 p.m.2 views

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup Table of Contents 소개 도전 과제 1부: 메모 수집 도전 과제 2부: YИИEႱ에게 전화 걸기 도전 과제 2A: 앨리스 도전 과제 2B: 밥 도전 과제 2C: 캐럴 도전 과제 2D: 댄 도전 과제 2E: 이브 도전 과제 2F: 트레버 도전 과제 3부: 마지막 실마리 컨퍼런스에서 전화기를 놓쳤다면? 뒤돌아보며 소개 안녕하세요! 저는 Pete입니다 - 일명 Kybr - 그리고 이것은 DEF CON 30 배지 챌린지에 대한 제 공략기입니다. 올해 챌린지는 음악과 해커...

5.9AI score
SaveExploits0References2
Rows per page
Query Builder