CVE-2025-55182

📌 CVE-2025-55182 — React2Shell Critical Unauthenticated Remote Code Execution RCE in React Server Components 📖 Overview CVE-2025-55182, informally dubbed React2Shell, is a critical remote code execution RCE vulnerability disclosed on December 3, 2025 in React Server Components RSC and related...

WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability

Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...

WordPress Integration for Epos Now and WooCommerce plugin 4.6.0-4.11.1 - Unauthenticated Action Scheduler Queue Disclosure vulnerability

Unauthenticated Action Scheduler Queue Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin Integration for Epos Now and WooCommerce versions 4.6.0-4.11.1...

CVE-2025-69457

CVE-2025-69457 – Responsive Tourism Website 3.1 Remote Code Execution RCE Unauthenticated WriteUp CVE-2025-69457 – ExploitDB 50049...

Webmin_CVE-2019-15107

CVE-2019–15107 - Unauthenticated RCE Webmin =1.920 This python script should give you a root shell on Webmin 1.890 Check with nmap: nmap -sC -sV -p 10000 TARGETIP Result: 10000/tcp open http MiniServ 1.890 Webmin httpd How to use this exploit: Step 1: nc -lnvp LPORT Step 2: chmod +x exploit.py...

WordPress String locator plugin < 2.6.8 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin String locator versions 2.6.8...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 Vulnerability Tester Description This PowerShell script is designed for authorized penetration testing purposes only. It tests Fortinet FortiWeb appliances for CVE-2025-25257, an unauthenticated SQL injection vulnerability in the /api/fabric/device/status endpoint...

CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Validation Lab Security-research material for reproducing and validating CVE-2026-87902 GHSA-7hp8-65ch-5whp in an isolated, loopback-only Docker lab: an unauthenticated local file inclusion in WordPress core page-template resolution,...

CVE-2026-82212

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82211

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-105322

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 Lab - MainWP Dashboard Stored XSS Vulnerable lab for CVE-2016-15041: Unauthenticated stored XSS in MainWP Dashboard WordPress plugin = 3.1.2. Quickstart docker compose up -d --build Wait 30 seconds for auto-setup. The lab prints a banner when ready: docker compose logs -f wordpress...

CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 - Unauthenticated Arbitrary File Upload Description The AR for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.2. This makes it possible for unauthenticated...

EUVD-2026-94196

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82211 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

EUVD-2026-94195

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-82211 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-82211

The Nexi XPay Build WordPress plugin through version 7.6.2 is vulnerable to unauthenticated payment completion and order key disclosure. The root cause is a failure to verify the payment result supplied to several unauthenticated routes. This allows an attacker to mark arbitrary orders as paid or...