153349 matches found
CVE-2026-82124
The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.66 fail to check whether a post is password-protected before including its content in the structured data it generates (specifically JSON-LD Schema Output ). This allows unauthenticated users to retrieve the content of...
WordPress Schema & Structured Data for WP & AMP plugin < 1.66 - Unauthenticated Password-Protected Post Content Disclosure vulnerability
Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.66...
CVE-2026-82125
CVE-2026-82125 affects the Schema & Structured Data for WP & AMP WordPress plugin, versions 1.46 through 1.65 . The plugin fails to verify comment ownership or moderation status before returning comment content, an IDOR (Insecure Direct Object Reference) flaw. This allows unauthenticated users to...
EUVD-2026-80188
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...
EUVD-2026-80185
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-82124 Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...
EUVD-2026-80184
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...
CVE-2026-77702
The Eventin (WP Event Solution) WordPress plugin before version 4.1.24 is vulnerable to an unauthenticated ticket price rewrite via a reused order_token. A token issued to a guest at checkout is not invalidated afterward, allowing an attacker to reuse it to modify that order's tickets — replacing...
telnetd_CVE-2026-24061_tester
Telnetd CVE-2026-24061 Test Script A Python security testing tool to detect vulnerability to environment variable injection in telnetd servers via the NEW-ENVIRON telnet option. Overview This script tests telnetd servers for CVE-2026-24061 , a vulnerability that allows attackers to inject...
react-cve-2025-55182
fix-react2shell A CLI tool to detect and fix the critical CVE-2025-55182 React2Shell vulnerability in React Server Components and Next.js applications. The Vulnerability CVE-2025-55182 is a critical CVSS 10.0 unauthenticated remote code execution vulnerability affecting: React Server DOM packages...
CVE-2023-0214
SWG Exploit Generator root@kitploit: ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhi...
CVE-2020-3452_Cisco_ASA_PathTraversal
CVE-2020-3452CiscoASAPathTraversal Script de prueba de concepto para CVE-2020-3452 — Vulnerabilidad de Path Traversal en Cisco ASA/FTD. Admite extracción automatizada de archivos objetivo conocidos con un límite estricto en descargas exitosas por seguridad. Destinado únicamente a pruebas de...
CVE-2025-58434
CVE-2025-58434 - Flowise unauthenticated account takeover, chained to CustomMCP RCE Two Flowise 3.0.5 issues, chained: 1. CVE-2025-58434 - password-reset token disclosure. POST /api/v1/account/forgot-password returns the target user's tempToken directly in the JSON response. Feed it to POST...
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...
CVE-2025-55182
🚨 CVE-2025-55182 — React2Shell CVE-2025-55182 es una vulnerabilidad crítica de Ejecución Remota de Código RCE que afecta a los Componentes del Servidor de React RSC. 📌 Resumen Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario en servidores vulnerables. El problema...
CVE-2024-5084
Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...
CVE-2025-60574
Descubridores de Vulnerabilidades y Autores de Exploits Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Descripción de la Vulnerabilidad Se ha identificado una vulnerabilidad de Inclusión de Archivos Locales LFI en tQuadra CMS 4.2.1117. El problema existe en la ruta "/styles/", que no...