697 matches found
easy-exploits
easy-exploits 该仓库包含了我过去发现的不同 CVE ID 的漏洞利用代码（CVE-2021-37910、CVE-2021-40288、CVE-2021-41435、CVE-2021-41436、CVE-2021-41437、CVE-2021-41441、CVE-2021-41442、CVE-2021-41445、CVE-2021-41449、CVE-2021-41450、CVE-2021-41451、CVE-2021-41753、CVE-2021-41788、CVE-2021-46353、CVE-2022-41540、CVE-2022-41541）。 动机...
cve-2018-9995
cve-2018-9995 利用存在CVE-2018-9995漏洞的摄像头 Novo CeNova QSee Pulnix XVR 5 in 1 title: "XVR Login" Securus, - Security. Never Compromise !! - Night OWL DVR Login HVR Login MDVR Login...
CVE-2018-9995_dvr_credentials
Herramienta Mostrar credenciales DVR root@kitploit: Título del Exploit: "Obtiene credenciales DVR" CVE: CVE-2018-9995 Puntuación Base CVSS v3: 7.3 / 10 Cadena de vector CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Fecha: 09/04/2018 Autor del Exploit: Fernandez Ezequiel twitter:@capitanalfa...
CVE-2026-81427
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81426
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81428
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability
Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81427
CVE-2026-81427 affects the WC Vendors WordPress plugin (WooCommerce marketplace) in versions before 2.7.2.1 . The root cause is a missing ownership verification on the front-end order shipment status change endpoint: any authenticated vendor can target another vendor's order, mark it as shipped ,...
CVE-2026-81428
CVE-2026-81428 affects the WC Vendors WordPress plugin in versions prior to 2.7.2.1 . The root cause is a missing ownership and object-type verification on user-supplied IDs during product variation saves, resulting in an Insecure Direct Object Reference (IDOR) flaw. An authenticated user with th...
EUVD-2026-69853
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
EUVD-2026-69855
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
EUVD-2026-69854
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability
Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81426
The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is missing CSRF protection on some front-end order shipment status actions. An attacker can craft a request that causes a logged-in vendor to unknowingly change the shipment status of their own orders, resulting in a low integrity impact ...
CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...
WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability
Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
MAL-2026-15523 Malicious code in sycm-vendors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a876475c44d594b90a19bc6c9bb3d5be6f6d0a19091218ef5e03f92e1b86e1 package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a...
Malicious code in sycm-vendors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a876475c44d594b90a19bc6c9bb3d5be6f6d0a19091218ef5e03f92e1b86e1 package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a...