All posts

exploit 2025-07-28

MagicAI: Authenticated File Upload to RCE via MIME-Type Manipulation

The MagicAI research repository documents an authenticated arbitrary file upload vulnerability in the Laravel + Vue SaaS application. The issue affects the chat file-analyzer upload feature, where insufficient validation between a declared MIME type and the actual file content can allow dangerous co...

4 min read read

exploit 2025-07-28

Davinci AI: IDOR in Team Management Endpoint

The Davinci AI research repository documents an Insecure Direct Object Reference vulnerability in the team-management functionality of a Laravel + Vue SaaS application. An authenticated user can potentially manipulate team data belonging to other users by changing a user-controlled team identifier.

4 min read read

CVE 2025-07-14

CVE-2025-5394: Unauthenticated Arbitrary Plugin Upload in Alone Theme

CVE-2025-5394 affects the Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3. The theme exposes a plugin-installation function without sufficient capability checks, allowing unauthenticated attackers to upload and install plugin packages from remote locations.

4 min read read

CVE 2025-07-08

CVE-2025-4606: Unauthenticated Password Reset and Account Takeover in Sala

CVE-2025-4606 affects the Sala – Startup & SaaS WordPress Theme through version 1.1.4. The vulnerability allows unauthenticated attackers to change passwords for arbitrary users, including administrators, because the password-update functionality does not properly establish the identity of the reque...

4 min read read

CVE 2025-07-03

CVE-2025-4601: Authenticated Privilege Escalation in RealHomes

CVE-2025-4601 affects the RH - Real Estate WordPress Theme through version 4.4.0. An authenticated user with subscriber-level access or higher can potentially manipulate their account role and escalate to administrator privileges.

4 min read read

exploit 2025-06-13

WorkDo Products: Authenticated Privilege Escalation via Role Manipulation

The WorkDo research repository documents an authenticated privilege-escalation issue affecting multiple Laravel-based WorkDo products. The issue is associated with account creation and role assignment, where a user-controlled role identifier can potentially be manipulated to obtain a higher-privileg...

4 min read read

exploit 2025-06-13

SmartEnd Laravel CMS: Authenticated Privilege Escalation via Role Tampering

The SmartEnd research repository documents an authenticated privilege-escalation issue in the SmartEnd Laravel CMS. A low-privilege authenticated user can potentially manipulate the permissions_id value used by the user-role update functionality and obtain elevated privileges.

4 min read read

exploit 2025-06-12

Streamit WordPress Theme: Subscriber File Upload to Remote Code Execution

The public Streamit research repository documents an authenticated arbitrary file upload vulnerability in the Streamit WordPress theme. A logged-in subscriber-level user can abuse the profile-avatar upload functionality when file-type validation is insufficient, creating a potential path to remote c...

4 min read read

CVE 2025-05-16

CVE-2025-47577: Unauthenticated Arbitrary File Upload in TI WooCommerce Wishlist

CVE-2025-47577 affects the TI WooCommerce Wishlist WordPress plugin through version 2.9.2. The issue is an unrestricted file upload vulnerability that can allow an unauthenticated attacker to place dangerous files on a vulnerable WordPress installation, with potential for remote code execution depen...

5 min read read