RED_HAWK

Version 2.0.0 By R3D@0R2H1N A.K.A Tuhinshubhra All in one tool for Information Gathering and Vulnerability Scanning Scans That You Can Perform Using RED HAWK : Basic Scan Site Title NEW IP Address Web Server Detection IMPROVED CMS Detection Cloudflare Detection robots.txt Scanner Whois Lookup...

CVE-2023-3452-PoC

CVE-2023-3452-PoC - Wordpress Plugin Canto 3.0.5 - Remote File Inclusion RFI - Remote Code Execution RCE - Unauthenticated Here we explain a PoC of the latest RFI Remote File Inclusion vulnerability of the Canto Wordpress Pluging, and we have developed an exploit to automate the execution of...

CVE-2026-15981

CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 SAML Single Sign On ≤ 5.4.4 — Unauthenticated Authentication Bypass Proof-of-Concept Exploit Malformed Signature → opensslverify returns -1 → PHP loose cast to true →...

CVE-2024-12404

CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Unauthenticated SQL Injection Description The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2026-12793

CVE-2026-12793 — JetFormBuilder Unauthenticated Privilege Escalation Proof-of-concept scanner and exploit for CVE-2026-12793 in the WordPress plugin JetFormBuilder — Dynamic Blocks Form Builder Crocoblock. | ---|--- CVE| CVE-2026-12793 Plugin| jetformbuilder Affected| ≤ 3.6.2 Fixed in| 3.6.2.1+...

wp-mhn

wp-mhn Integrates your Modern Honeypot Network Server and your Wordpress Blog via MHN's REST API and WP's shortcodes Installation and Usage 1. Download wp-mhn as a zip file, or clone the repo and compress it. 2. Edit config.sample.php with information corresponding to your MHN server. 3...

poc-cve-xss-uploading-svg

Details Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS Date: 2023-08-10 Author: Danilo Albuquerque Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download Version: WordPress 6.3 Plugin's Name and...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - Unauthenticated Content Spoof CVE-2025-32259 🔬 A simple PoC demonstrating CVE-2025-32259 in the WP ULike plugin for WordPress. 🚨 Educational use only – do not test on systems without explicit authorization. 🧠 Overview WP ULike is a popular WordPress plugin that allows users t...

wpstorecart-exploit

Simple PoC of wpstorecart before 2.5.30 plugin exploit CVE-2012-3576 written in bash...

wordpress-CVE-2024-10924--exploit

🚀 WordPress Really Simple Security Plugin Vulnerability CVE-2024-10924 📌 Overview WordPress is one of the most popular open-source Content Management Systems CMS, powering millions of websites worldwide—from personal blogs to full-fledged e-commerce platforms. However, in November 2024 , a critic...

CVE-2024-55972

CVE-2024-55972 eTemplates = 0.2.1 - Unauthenticated SQL Injection Description The eTemplates plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2026-92966

CVE-2026-92966 — LatePoint ≤ 5.7.0 unauthenticated stored shortcode execution Field| Value ---|--- CVE| CVE-2026-92966 Product| LatePoint — Appointment Booking Affected| ≤ 5.7.0 Fixed| 5.7.1 CWE| CWE-94 — Code injection shortcode execution CVSS 3.1| 9.1 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data. Authorization...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Unauthenticated Arbitrary File Download Description The Woocommerce Product Design plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to rea...

CVE-2025-8723

⚡️ Cloudflare Image Resizing Description: The plugin's REST API endpoint fails to authenticate users and improperly sanitizes input in the hookrestpredispatch method. This flaw enables attackers to inject and execute arbitrary PHP code by crafting malicious requests — with no login required. 🛠...

CVE-2024-27954

⚠️ CVE-2024-27954 💀 Automatic Remote code Execution Exploit Tools | By GhostSec 💀 📝 Description Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from...

CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...