CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Codeausführung aus /core/shortcodes/cla...

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments taskbuckets and task ordering taskpositions of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to...

GHSA-GG93-X632-9CCV Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments taskbuckets and task ordering taskpositions of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to...

CVE-2024-6366

Per creare un modulo Metasploit per sfruttare la vulnerabilità RCE nel plugin WordPress User Profile Builder precedente alla versione 3.11.8, dobbiamo sfruttare la mancanza di autorizzazione appropriata nella funzionalità di caricamento dei file multimediali. Ecco come creare un tale modulo...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime. These vulnerabilities are addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...

patator

Patator Patator è stato scritto per frustrazione nell'usare Hydra, Medusa, Ncrack, i moduli Metasploit e gli script NSE di Nmap per attacchi di indovinamento delle password. Ho optato per un approccio diverso per non creare un altro strumento di brute force ed evitare di ripetere gli stessi...

Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

GHSA-F27P-PW2P-9PR4 Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

CVE-2024-54292

CVE-2024-54292 Appsplate = 2.1.3 - Iniezione SQL non autenticata Descrizione Il plugin Appsplate per WordPress è vulnerabile all'iniezione SQL nelle versioni fino alla 2.1.3 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una preparazione adegua...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Iniezione SQL non autenticata Descrizione Il plugin Fancy Product Designer per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 6.4.3 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di...

Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office

Summary axios versions before 1.18.0 0.x: before 0.33.0 have multiple vulnerabilities CVSS up to 8.3, High. CVE-2026-67312/67313 are uncontrolled recursion issues in formDataToJSON that exhaust the call stack via deeply nested field names, causing denial of service. CVE-2026-67314/67316/67319 are...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-12471

CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator input type="hidden" name="imageprompt" value...

CVE-2024-12404

CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Iniezione SQL non autenticata Descrizione Il plugin CF Internal Link Shortcode per WordPress è vulnerabile all'Iniezione SQL tramite il parametro 'posttitle' in tutte le versioni fino alla 1.1.0 inclusa, a causa di un escaping insufficiente sul...

CVE-2024-12157

CVE-2024-12157 Popup – MailChimp, GetResponse and ActiveCampaign Intergrations = 3.2.6 - Nicht authentifizierte SQL-Injection Beschreibung Das Plugin Popup – MailChimp, GetResponse and ActiveCampaign Intergrations für WordPress ist in allen Versionen bis einschließlich 3.2.6 anfällig für...

swap_digger

swapdigger swapdigger é um script bash usado para automatizar a análise de swap do Linux para fins de pós-exploração ou perícia forense. Ele automatiza a extração de swap e procura por credenciais de usuário Linux, credenciais de formulários web, e-mails de formulários web, autenticação básica...

whatsapp-media-decrypt

WhatsApp Media Decrypt Una recente indagine forense di alto profilo ha riportato che “a causa della crittografia end-to-end utilizzata da WhatsApp, è praticamente impossibile decifrare il contenuto del file scaricato file .enc per determinare se contenesse codice malevolo oltre al video...

CVE-2024-55980

CVE-2024-55980 Wr Age Verification = 5.0.12 time-based blind - Parameter replace Payload:...

CVE-2024-55976

CVE-2024-55976 Critical Site Intel = 1.0 - Iniezione SQL non autenticata Descrizione Il plugin Critical Site Intel per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.0 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una...

cPanel-WHM-CVE-2026-41940-auth-bypass-exploit

CVE-2026-41940 - cPanel & WHM Authentifizierungs-Bypass-Exploit Kritischer Authentifizierungs-Bypass durch CRLF-Injection im cPanel/WHM-cpsrvd-Daemon 📋 Übersicht Bei CVE-2026-41940 handelt es sich um eine kritische Authentifizierungs-Bypass-Schwachstelle in cPanel & WHM, die nicht authentifiziert...