CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

CVE-2025-12139: Integrate Google Drive WordPress Plugin - Information Disclosure Exploit Description This is a Golang Proof of Concept PoC exploit for CVE-2025-12139. The vulnerability exists in the Integrate Google Drive plugin versions = 1.5.3 for WordPress. It allows unauthenticated attackers ...

CVE-2025-65270

CVE-2025-65270 ⚠️ Disclaimer This repository is for educational and defensive security research only 🔥 Overview Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3 , allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's...

CVE-2023-0669-Analysis

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux https://www.dropbox.com/s/j31l8lgvapbopy3/ga703linuxx64.sh?dl=0...

CVE-2025-61882

Oracle E-Business Suite RCE 扫描器 CVE-2025-61882 一个快速、多线程的批量扫描器，用于检测 Oracle E-Business Suite 安装中的 CVE-2025-61882。该严重漏洞允许未经身份验证的远程代码执行。 🎯 功能特性 批量扫描 - 从文件中处理数百或数千个目标 多线程 - 可配置的并发扫描（默认：20 个线程） 自动检测 - 通过执行 id 命令并解析输出来验证 RCE 实时结果 - 易受攻击的目标会立即写入 vuln-output.txt 随机端口 - 为每个目标使用随机端口（2000-9999）以避免冲突 简洁输出...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE CVE-2023-43208 のProof-of-Conceptエクスプロイトです。これは、Mirth Connect のバージョン 4.4.1 未満における、認証不要のリモートコード実行（RCE）脆弱性です。 説明 Mirth Connectは広く使われているオープンソースのヘルスケア統合エンジンです。この脆弱性は、Apache Commons Collectionsのガジェットをチェーン化した細工されたXMLペイロードを使用して、/api/users...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

CVE-2025-69458

CVE-2025-69458 – Movie Rating System 1.0 SQLi to RCE Unauthenticated WriteUp CVE-2025-69458 – ExploitDB 50622...

CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

EUVD-2026-80099

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-78088

The Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) versions up to and including 32.0.1 are affected by an Unauthenticated Arbitrary File Overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter . Attackers...

CVE-2026-18595 WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

EUVD-2026-80097

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-11984 Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-11984

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is affected by an authorization bypass in all versions up to and including 2.8.16 . The root cause is a missing capability check on the ai-debug-code URL-parameter, which allows unauthenticated attackers to view administrator-configu...

CVE-2026-12793

JetFormBuilder — Dynamic Blocks Form Builder for WordPress (by Crocoblock/jetmonsters) is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.6.2 . The root cause is that the plugin does not validate that the _jet_engine_booking_form_id parameter refers to a p...

EUVD-2026-80096

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2018-0296

Cisco Adaptive Security Appliance - Path Traversal CVE-2018-0296 Author: Yassine Aboukir A security vulnerability identified in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques. Vulnerable Products This...