📄 MouseHero 1.2.0+1 Remote Power Control

MouseHero version 1.2.0+1 contains an unauthenticated remote power control vulnerability in its remote control protocol. An attacker on the local network can send crafted control packets to force a target system to sleep, restart, or power off without user interaction. The repository contains a...

📄 SIP Sustainable Irrigation Platform 5.x Cross Site Request Forgery

SIP Sustainable Irrigation Platform version 5.x performs state-changing actions through HTTP GET requests without including any anti-CSRF token or validating the request origin. This can be exploited to perform administrative actions such as disabling the passphrase, rebooting the device, deletin...

📄 SIP Sustainable Irrigation Platform 5.x Cross Site Scripting

SIP Sustainable Irrigation Platform version 5.x stores program names supplied through HTTP requests and later renders them into its web pages without proper output encoding. This can be exploited to execute arbitrary JavaScript in the browser of any user who views the affected pages by creating a...

📄 SIP Sustainable Irrigation Platform 5.x Path Traversal

SIP Sustainable Irrigation Platform version 5.x Backup/Restore functionality suffers from a path traversal vulnerability. The keys in the JSON backup file which have been uploaded are not validated when they are used to generate file paths. An attacker with access to the restore feature can use t...

📄 ThorVG SVG Parser NULL Pointer Dereference

A proof of concept exploit for ThorVG version prior to 1.0.5 demonstrates a NULL pointer dereference vulnerability in the SVG parser. A malformed, truncated child element within a root svg node causes createElement to return a NULL pointer which is subsequently dereferenced by parseStyle without...

📄 WordPress Masteriyo LMS 1.7.1 Privilege Escalation

WordPress Masteriyo LMS learning-management-system plugin version 1.7.1 contains an authenticated Student+ privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit...

📄 WordPress YayExtra 1.3.6 Unauthenticated Shell Upload

WordPress YayExtra WooCommerce Extra Product Options plugin version 1.3.6 suffers from an unauthenticated shell upload vulnerability that achieves remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Explo...

📄 WordPress Hippoo 1.9.5 Unauthenticated Admin Account Takeover

WordPress Hippoo plugin version 1.9.5 contains an unauthenticated admin account takeover vulnerability through REST. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3...

📄 WordPress Ads by WPQuads / Quick AdSense Reloaded 2.0.87 Unauthenticated SQL Injection

WordPress Ads by WPQuads / Quick AdSense Reloaded plugin version 2.0.87 contains an unauthenticated SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request fl...

📄 WordPress WPCargo Track and Trace 7.0.6 Unauthenticated SQL Injection

WordPress WPCargo Track and Trace plugin version 7.0.6 contains an unauthenticated SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation

WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...

📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover

WordPress Login Customizer plugin version 2.5.3 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affect...

📄 WordPress Category Ajax Filter 2.8.2 Unauthenticated Local File Inclusion / Code Execution

WordPress Category Ajax Filter plugin version 2.8.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already...

📄 WordPress News and Blog Designer Bundle 1.1 LFI / Remote Code Execution

WordPress News and Blog Designer Bundle plugin version 1.1 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Popup Builder Block 2.1.5 Blind SQL Injection

WordPress Popup Builder Block PopupKit plugin version 2.1.5 contains an authenticated Subscriber+ time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Quotes llama 3.1.4 Unauthenticated Blind SQL Injection

WordPress Quotes llama plugin version 3.1.4 contains an unauthenticated time-based blind SQL injection vulnerability through selectsearch. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Copymatic 1.6 Unauthenticated Shell Upload

WordPress Copymatic plugin version 1.6 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress Simple User Capabilities 1.0 Unauthenticated Privilege Escalation

WordPress Simple User Capabilities plugin version 1.0 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress Royal Elementor Addons 1.3.78 Unauthenticated Shell Upload

WordPress Royal Elementor Addons plugin version 1.3.78 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request fl...

📄 WordPress Optional Email 1.3.11 Unauthenticated Administrator Account Takeover

WordPress Optional Email plugin version 1.3.11 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affecte...

📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover

WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...

📄 WordPress Easy Quotes 1.2.2 Unauthenticated Blind SQL Injection

WordPress Easy Quotes plugin version 1.2.2 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

📄 WordPress Registration Password 1.0.1 Unauthenticated Administrator Account Takeover

WordPress Registration Password plugin version 1.0.1 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection

WordPress Community Events plugin version 1.5.1 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress FormGent 1.6.0 Unauthenticated Arbitrary File Deletion

WordPress FormGent plugin version 1.6.0 contains an unauthenticated arbitrary file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable request flow against the affected...

📄 WordPress Easy Elements 1.4.8 Unauthenticated Privilege Escalation

WordPress Easy Elements Elementor Addon plugin version 1.4.8 contains an unauthenticated privilege escalation to administrator vulnerability. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Exploit Title: WordPress Plugin...

📄 WordPress Drag and Drop Multiple File Upload for Contact Form 7 1.3.8.6 File Deletion

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin version 1.3.8.6 contains an unauthenticated arbitrary file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the...

📄 WordPress LeadConnector 1.7 Unauthenticated Arbitrary Post Deletion

WordPress LeadConnector plugin version 1.7 contains an unauthenticated arbitrary post deletion vulnerability. A remote attacker can delete arbitrary WordPress posts without authorization. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin...

📄 WordPress Quiz and Survey Master 10.2.4 Authenticated Contributor SQL Injection

WordPress Quiz And Survey Master plugin version 10.2.4 contains an authenticated Contributor+ SQL injection vulnerability through REST. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable...

📄 WordPress Attachment Manager 2.1.2 File Deletion / Path Traversal

WordPress Attachment Manager plugin version 2.1.2 contains an unauthenticated arbitrary file deletion vulnerability through path traversal. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable...

📄 WordPress AI Image 1.5.1 Unauthenticated Shell Upload

WordPress AI Image WP AI Image Generator plugin version 1.5.1 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable...

📄 WordPress Invoice Creator 1.0.0 Unauthenticated Account Takeover

WordPress Invoice Creator plugin version 1.0.0 contains an unauthenticated account takeover vulnerability through Arbitrary User Email Change. A remote attacker can take over another user account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin...

📄 WordPress LearnPress 4.3.2.8 Unauthenticated Quiz Answer Deletion

WordPress LearnPress plugin version 4.3.2.8 contains an unauthenticated quiz answer deletion vulnerability through a broken access control. A remote attacker can delete quiz answers without authorization. This proof of concept exploit demonstrates the vulnerable request flow against the affected...

📄 WordPress WP User Frontend 4.2.4 Unauthenticated Arbitrary Attachment/File Deletion

WordPress WP User Frontend plugin version 4.2.4 contains an unauthenticated arbitrary attachment/file deletion vulnerability. A remote attacker can delete arbitrary files accessible to the affected WordPress installation. This proof of concept exploit demonstrates the vulnerable request flow...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

📄 WordPress ActiveDEMAND 0.2.40 Unauthenticated Shell Upload

WordPress ActiveDEMAND plugin version 0.2.40 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against...

📄 WordPress Easy Form Builder 3.8.14 Unauthenticated Blind SQL Injection

WordPress Easy Form Builder plugin version 3.8.14 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrate...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Feedzy RSS Feeds 4.4.1 SQL Injection

WordPress Feedzy RSS Feeds plugin version 4.4.1 contains an authenticated Author+ SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Simply Schedule Appointments 1.6.9.25 Unauthenticated Blind SQL Injection

WordPress Simply Schedule Appointments plugin version 1.6.9.25 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploi...

📄 WordPress Charitable 1.7.0.12 Unauthenticated Privilege Escalation

WordPress Charitable plugin version 1.7.0.12 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the vulnerable request...

📄 WordPress Salon Booking System 9.5 Unauthenticated Shell Upload

WordPress Salon Booking System plugin version 9.5 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow...

📄 WordPress Age Gate 3.5.2 Unauthenticated LFI / Remote Code Execution

WordPress Age Gate plugin version 3.5.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already present. This...

📄 WordPress CE21 Suite 2.3.1 Unauthenticated SSO API Settings Overwrite

WordPress CE21 Suite plugin version 2.3.1 contains an unauthenticated SSO api settings overwrite vulnerability through missing authorization. A remote attacker can overwrite SSO API configuration without authorization. This proof of concept exploit demonstrates the vulnerable request flow against...

📄 WordPress WooCommerce Simple Registration 1.5.6 Unauthenticated Privilege Escalation

WordPress WooCommerce Simple Registration plugin version 1.5.6 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress Booking Activities 1.16.43 Authentication Bypass

WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...