osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

LegacyHive

LegacyHive : Vulnerabilidad de elevación de privilegios por carga arbitraria de hive en el servicio de perfil de usuario de Windows El PoC requiere las credenciales de otro usuario estándar y un tercer nombre de usuario que puede ser una cuenta de administrador. Si el PoC tiene éxito, terminará...

profilehound

root@kitploit: / \ / / / / / / / / / // / / / // / / / // / / / / / / / / / / / // / / / / / / // / // / / / / // / // // // ///// ///,// //,/ ProfileHound ProfileHound es una herramienta post-escalada que ayuda a encontrar y alcanzar objetivos de red team localizando perfiles de usuario...

User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

User Profile Picture < 2.5.0 - Sensitive Information Disclosure

The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...

Moodle-CVE-2019-3810

Moodle CVE-2019-3810 Moodle 3.6.2, 3.5.4, 3.4.7, 3.1.16 XSS PoC para escalada de privilegios Estudiante a Admin. Este es uno de los errores pasados que descubrí durante un pentest anterior en una institución académica. Fue lo suficientemente exitoso en ese momento para prácticamente robar el acce...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Luego visualiza una publicación hecha por el autor para desencadenar el XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2020-25627

CVE-2020-25627 XSS almacenado a través del parámetro moodlenetprofile en el perfil de usuario Mi PoC sobre este CVE Requisito de usuario: Estudiante o el sitio para registro XSS en moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new use...

CVE-2019-0986

Investigación de seguridad por diversión Todo enfocado en el sistema operativo Microsoft Windows CVE-2019-0986 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0986 Este es el PoC que envié a Microsoft cuando reporté la vulnerabilidad anterior. Este PoC explota "User...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Subida de medios sin autenticación Descripción El plugin User Profile Builder de WordPress anterior a 3.11.8 no cuenta con la autorización adecuada, lo que permite a usuarios no autenticados subir archivos multimedia mediante la funcionalidad de...

CVE-2025-55182-PoC

CVE-2025-55182-PoC PoC para CVE-2025-55182 root@kitploit: Usage: python3 poc.py -u http://target.com --cmd "" Aviso legal Esta herramienta se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. El uso de esta herramienta para atacar objetivos sin consentimiento...

CVE-2024-6366

To create a Metasploit module to exploit the RCE vulnerability in the User Profile Builder WordPress plugin before version 3.11.8, we need to take advantage of the lack of proper authorization in the media file upload functionality. Here is how you can create such a Metasploit module: Metasploit...

CVE-2022-38577-Processmaker

Este repositorio ha sido archivado y movido a: https://github.com/sornram9254/CVE-BBP-VDP ProcessMaker - Escalada de Privilegios en el Perfil de Usuario CVE-2022-38577 Se descubrió que ProcessMaker anterior a v3.5.4 contiene permisos inseguros en la página de perfil de usuario. Esta vulnerabilida...

CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - Restablecimiento de contraseña arbitrario sin autenticación CVE-2025-15030 User Profile Builder — Restablecimiento de contraseña sin autenticación → Toma de control de administrador + Subida de shell root@kitploit: / / \ |/ / / / / / \ / / / \ /...

CVE-2026-5399

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-19945

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...