CVE-2026-78088

The Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) versions up to and including 32.0.1 are affected by an Unauthenticated Arbitrary File Overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter . Attackers...

CVE-2026-18595 WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

EUVD-2026-80097

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-12793

JetFormBuilder — Dynamic Blocks Form Builder for WordPress (by Crocoblock/jetmonsters) is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.6.2 . The root cause is that the plugin does not validate that the _jet_engine_booking_form_id parameter refers to a p...

CVE-2026-11984

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is affected by an authorization bypass in all versions up to and including 2.8.16 . The root cause is a missing capability check on the ai-debug-code URL-parameter, which allows unauthenticated attackers to view administrator-configu...

EUVD-2026-80096

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2018-0296

Cisco自适应安全设备 - 路径遍历 CVE-2018-0296 作者: Yassine Aboukir 在Cisco ASA中发现的一个安全漏洞，允许攻击者通过目录遍历技术，在无需认证的情况下查看敏感系统信息。 受影响产品 该漏洞影响运行在以下Cisco产品上的Cisco ASA软件和Cisco Firepower威胁防御（FTD）软件： root@kitploit: 3000 Series Industrial Security Appliance ISA ASA 1000V Cloud Firewall ASA 5500 Series Adaptive Security...

CVE-2022-46169

CVE 2022-46169 Este script explota una vulnerabilidad de inyección de comandos no autenticada en versiones de Cacti hasta la 1.2.22 para lograr ejecución remota de código no autenticada y obtener una shell inversa...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework 📡 不要错过下一次发布。 在 Telegram 上关注 @KNxploited —— 获取最新披露的 CVE、可用漏洞利用程序和顶级安全研究的权威频道。第一时间知晓，第一时间行动。 🧠 概述 CVE-2025-6389 是 WordPress 的 Sneeit Framework 插件中存在的一个 CVSS 9.8 严重 远程代码执行漏洞。 该漏洞存在于 sneeitarticlespaginationcallback 函数中，该函数盲目地将用户提供的输入 传递给 PHP 的...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Ejecución Remota de Código en MCPJam Inspector Referencia https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

PoC-CVE-2026-33017

CVE-2026-33017: Unauthenticated RCE in Langflow = 1.8.2 Description A critical code injection vulnerability exists in Langflow that allows an unauthenticated remote attacker to execute arbitrary Python code on the server. The vulnerability resides in the POST /api/v1/buildpublictmp/flowid/flow...

CVE-2026-73450

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 The intel drops here first. Follow @KNxploited on Telegram — precision CVE disclosures, working exploits, and deep-dive vulnerability research. The channel for those who don't wait for the news — they make it. 🧠 Overview CVE-2025-15403 is a CVSS 9.8 Critical...

cve-2023-22515

CVE-2023-22515 Aquí se describe la lógica de explotación de la vulnerabilidad mediante Burp Suite. Para la explotación es necesario cambiar el valor del atributo bootstrapStatusProvider.applicationConfig.setupComplete a false, es decir, realizar la solicitud: Cambio de Confluence al modo de...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV exact-profile RCE y reproducción de la variante root Este directorio es un paquete de reproducción independiente, para laboratorio autorizado, de la cadena de ejecución de código de ZendTo a ClamAV sin cuenta y de su continuación separada mediante Smarty/cron root con el...

CVE-2025-62593-PoC

CVE-2025-62593 — Ray Ejecución Remota de Código sin autenticación Prueba de concepto para CVE-2025-62593 , una vulnerabilidad de Ejecución Remota de Código sin autenticación en el motor de computación distribuida de IA Ray, explotada mediante ataques de rebinding de DNS basados en navegador. Fue...