147279 matches found
CVE-2025-59287-When-your-patch-server-becomes-the-attack-vector
CVE-2025-59287 — When your patch server becomes the attack vector 🗿 TL;DR: Microsoft patched a critical unauthenticated remote code execution RCE vulnerability in Windows Server Update Services WSUS that’s already being exploited in the wild. The issue stems from unsafe deserialization of...
CVE-2026-76595
A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...
CVE-2026-59683
A flaw was found in the OpenRGB network SDK protocol. Profile names received over the network are used directly in filesystem path construction without sanitization, allowing unauthenticated remote attackers to write attacker-controlled data to arbitrary filesystem paths via path traversal. By...
CVE-2026-45332-PoC
CVE-2026-45332: Control de acceso roto en Automad CMS Prueba de concepto para CVE-2026-45332 , una vulnerabilidad de Control de Acceso Roto en Automad CMS que permite a cualquier atacante no autenticado volcar el hash de contraseña bcrypt y el secreto TOTP de todas las cuentas de administrador a...
CVE-2026-0770
CVE-2026-0770: Langflow execglobals Ejecución Remota de Código No Autenticada PoC CVE-2026-0770 es una vulnerabilidad de Ejecución Remota de Código RCE no autenticada que afecta a Langflow. El fallo se origina por una validación de entrada incorrecta en el manejo del parámetro execglobals...
CVE-2021-25094-tatsu-preauth-rce
Preauth RCE en el plugin Tatsu builder de WordPress CVE-2021-25094 PoC simple de un RCE no autenticado en Tatsu Builder = 3.3.11 proporcionado como ejemplo. Análisis completo aquí: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ Uso: root@kitploit: python3 exploit-rce.py...
CVE-2026-2811
The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...
CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
EUVD-2026-70050
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
CVE-2025-9314
The Developer Tools WordPress plugin through version 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in its bundled SWFUpload component. This allows a remote, unauthenticated attacker to upload arbitrary files over the network with low complexity, rated CVSS 3.1: 9.8 (Critic...
EUVD-2025-210834
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
CVE-2025-15490
Passster WordPress plugin versions before 4.2.26 contain a flaw in its global protection checks , enabling unauthenticated users to bypass the plugin's protection mechanism via crafted URLs. The impact is rated Medium (CVSS 5.3) with a low confidentiality impact and no integrity or availability i...
CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...
CVE-2025-15490 Passster < 4.2.26 - Global Protection Bypass
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...
EUVD-2025-210832
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...
CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...