1291156 matches found
Aether-C2-Framework
🌌 Aether-C2-Framework - Powerful Tools for Cybersecurity Training Download Aether-C2-Framework 🚀 Getting Started Welcome to the Aether-C2-Framework! This guide will help you download and run the framework easily, even if you're not a tech expert. 🛠️ System Requirements Before downloading the...
Firework
⚠️ NOTE: This tool is no longer under active maintenance. Firework Firework is a proof of concept tool to interact with Microsoft Workplaces creating valid files required for the provisioning process. The tool also wraps some code from Responder to leverage its ability to capture NetNTLM hashes...
CVE-2024-9264
CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Python proof of concept for CVE-2024-9264, a Grafana SQL Expressions vulnerability that can allow authenticated local file inclusion and command execution when duckdb is available in the Grafana process PATH. For authorized testing and...
EUVD-2026-103215
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
CVE-2026-109208
The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.4.10 . The root cause is insufficient input sanitization and output escaping within the 'quantity (REST)' and 'order_comments (checkout)' parameters. This allows an attacker ...
CVE-2026-111601
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.12.0 . The root cause is insufficient input sanitization and output escaping of the 'token_id' parameter. Specifically, while the URL path regex c...
EUVD-2026-103216
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
EUVD-2026-103213
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-107762 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-107762 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-107762
The Kirki WordPress plugin (versions up to and including 6.3.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from a missing validation on a user-controlled key within the 'context' parameter , allowing unauthenticated attackers to perform context smuggling . This...
EUVD-2026-103212
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-lev...
CVE-2026-107763 Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-lev...
CVE-2026-107763
The Fastcache by Host.it plugin for WordPress, in versions up to and including 1.7.5 , is vulnerable to an authorization bypass (CWE-862). The plugin fails to properly verify user permissions when executing the updateSettings() function via the admin_action_update hook. This allows authenticated ...
CVE-2026-107763 Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-lev...
tmux-fuzzing
Fuzzing Lab: Enhancing Fuzzing for tmux Software Security @ EPFL, Spring 2025 Abstract In this lab, we enhanced the fuzzing efforts for the tmux terminal multiplexer within Google's OSS-Fuzz infrastructure. We first established a baseline by evaluating the line coverage of the existing input-fuzz...