new tests
February 20, 2026
Now testing for the following vulnerabilities
New tests built and released by Alfred, our AI Security Researcher:
Haven't met Alfred yet? You can read more about how we're using AI to discover, source, and build tests for CVEs here.
- CVE-2025-2011: WordPress Plugin "Depicter / Popup & Slider Builder" (depicter) SQL Injection via unsanitized parameter [8.7 / High]
- CVE-2024-42009: RoundCube "message_body()" Reflected XSS [7.4 / High]
- CVE-2017-15944: Palo Alto Networks PAN-OS "readSessionVarsFromFile()" Remote Code Execution [9.3 / Critical]
New tests released based on submissions by our Detectify Crowdsource hackers:
- CVE-2026-24128: XWiki Platform Distribution Reflected XSS [5.1 / Medium]
- CVE-2026-21891: ZimaOS Authentication Bypass [8.9 / High]
- CVE-2026-1356: WordPress Plugin "Converter for Media / Optimize images / Convert WebP & AVIF" (webp-converter-for-media) <= 6.5.1 Unauthenticated Server-Side Request Forgery via src [2.1 / Low]
- CVE-2025-55749: XWiki File Exposure [6.9 / Medium]
- CVE-2025-53533: Pi-hole Reflected XSS [6.9 / Medium]
- CVE-2025-48827: vBulletin Authentication Bypass [8.9 / High]
- CVE-2025-46822: Java Spring Boot 1.1 Arbitrary File Read [8.7 / High]
- CVE-2025-46550: YesWiki < 4.5.4 Cross-Site Scripting [6.9 / Medium]
- CVE-2025-46549: YesWiki <= 4.5.1 Cross-Site Scripting [6.9 / Medium]
- CVE-2025-14155: WordPress Plugin "Premium Addons for Elementor / Powerful Elementor Templates & Widgets" (premium-addons-for-elementor) <= 4.11.53 Unauthenticated Template Content Disclosure [6.9 / Medium]
- CVE-2025-11427: WordPress Plugin "WP Migrate Lite / Migration Made Easy" (wp-migrate-db) Server-Side Request Forgery via remote URL fetch [5.5 / Medium]
- CVE-2025-5350: WSO2 Carbon Server SSRF [5.3 / Medium]
- CVE-2025-0215: WordPress "UpdraftPlus: WP Backup & Migration Plugin" (updraftplus) Reflected XSS [6.3 / Medium]
- CVE-2024-37359: Hitachi Vantara Pentaho Business Analytics Server SSRF [8.7 / High]
- CVE-2024-8852: WordPress Plugin "All-in-One WP Migration and Backup" (all-in-one-wp-migration) <= 7.86 Unauthenticated Error Log Information Disclosure [6.9 / Medium]
- CVE-2023-2745: WordPress Core <=6.2 Directory Traversal [6.9 / Medium]
- CVE-2022-42118: Liferay Portal Reflected XSS [6.9 / Medium]
- AzuraCast Unfinished Install [7.8 / High]
- CodeMeter Webadmin Dashboard Exposure [6.9 / Medium]
- Doccano default credentials [6.9 / Medium]
- Python pyinfo Exposure [5.5 / Medium]
- SPIP CMS Server Side Template Injection That Leads to RCE [9.3 / Critical]
- Librespeed Speedtest Dashboard Exposure [6.9 / Medium]
- Microsoft Azure Shared Access Signature (SAS) Token Exposure [6.9 / Medium]
- SPIP Installer Exposure [5.0 / Medium]
- CVE-2021-3154: SolarWinds Serv-U Cleartext Password Disclosure [6.9 / Medium]
- CVE-2020-24589: WSO2 API Manager <=3.1.0 Blind XXE [8.8 / High]
- CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution [10.0 / Critical]
- CVE-2018-10100: WordPress Login Open Redirect [5.3 / Medium]
- CVE-2017-5487: WordPress REST API Username Enumeration [6.9 / Medium]
- CVE-2016-10961: InkThemes ColorWay WordPress Theme "contactName" Reflected XSS [5.3 / Medium]
- CVE-2016-6195: vBulletin ForumRunner SQL Injection [9.3 / Critical]
- CVE-2016-4567: WordPress MediaElement.js "flashmediaelement.swf" Reflected XSS [5.3 / Medium]
- CVE-2016-4566: WordPress Plupload Flash Cross-Site Scripting [5.3 / Medium]
- CVE-2014-4663: WordPress TimThumb "WebShot" Remote Code Execution [9.3 / Critical]
- CVE-2014-1869: TeamCity "ZeroClipboard.swf" Reflected XSS [6.3 / Medium]
- CVE-2013-2204: WordPress Moxieplayer TinyMCE Media Open Redirect [6.3 / Medium]
- CVE-2013-1808: Zendesk Chat "ZeroClipboard" Cross-Site Scripting [6.3 / Medium]
- CVE-2011-4106: WordPress TimThumb Remote Code Execution [9.3 / Critical]
- Git Ignore File (".gitignore") Exposure [6.9 / Medium]
- GitHub Button DOM XSS [5.3 / Medium]
- Laravel Log Viewer Path Traversal [8.7 / High]
- PHP UnZIP Path Traversal [6.9 / Medium]
- Ruby Bundler Gemfile Exposure [6.9 / Medium]
- TenderApp Open Redirect [5.3 / Medium]
- Ultimate Bulletin Board Email Address Disclosure [6.9 / Medium]
- Umbraco Data Exposure / Directory Listing [6.9 / Medium]
- WordPress Author ID Username Enumeration [6.9 / Medium]
- WordPress Couponer Plugin SQL Injection [9.3 / Critical]
- WordPress Crayon Syntax Highlighter Reflected XSS [5.3 / Medium]
- WordPress Database Dump Exposure [8.7 / High]
- WordPress Database PHP Source Code Exposure [6.9 / Medium]
- WordPress Easy Contact Form Lite Plugin SQL Injection [9.3 / Critical]
- WordPress Easy Tables VC GitHub Button DOM XSS [5.3 / Medium]
- WordPress Error Log Exposure [6.9 / Medium]
- WordPress Evarisk Plugin SQL Injection [9.3 / Critical]
- WordPress Facebook OpenGraph Meta Plugin SQL Injection [9.3 / Critical]
- WordPress File-Manager Log Exposure [6.9 / Medium]
- WordPress Gadgetry Parent Theme Reflected XSS [5.3 / Medium]
- WordPress Global Content Blocks Plugin SQL Injection [9.3 / Critical]
- WordPress JS Appointment Plugin SQL Injection [9.3 / Critical]
- WordPress JSONP Flash XSS (Rosetta) [5.3 / Medium]
- WordPress Media Library Categories Plugin SQL Injection [9.3 / Critical]
- WordPress Moxie Flash XSS [5.3 / Medium]
- WordPress Pinfinity Theme Reflected XSS [5.3 / Medium]
- WordPress Plugin "10WebSocial" (wd-instagram-feed) Reflected XSS [5.3 / Medium]
- WordPress Plugin "Allow PHP in Posts and Pages" SQL Injection [9.3 / Critical]
- WordPress Plugin "Comments / wpDiscuz" (wpdiscuz) Reflected XSS [5.3 / Medium]
- WordPress Plugin "Contus HD FLV Player" SQL Injection [9.3 / Critical]
- WordPress Plugin "File Groups" (file-groups) SQL Injection via unsanitized input [9.3 / Critical]
- WordPress Plugin "Gmedia Photo Gallery" (grand-media) Flash Reflected XSS [5.3 / Medium]
- WordPress Plugin "MySliderGallery" (mygallery) Remote File Inclusion via Unvalidated File Parameter [9.3 / Critical]
- WordPress Plugin "Name: oQey Headers" (oqey-headers) SQL Injection [9.3 / Critical]
- WordPress Plugin "Nonprofit Donation" SQL Injection [9.3 / Critical]
- WordPress Plugin "Odihost Newsletter" SQL Injection [9.3 / Critical]
- WordPress Plugin "PhotoRacer" SQL Injection [9.3 / Critical]
- WordPress Plugin "ProPlayer" SQL Injection [9.3 / Critical]
- WordPress Plugin "Robo Gallery / Photo & Image Slider" (robo-gallery) Remote Code Execution [9.3 / Critical]
- WordPress Plugin "Search Autocomplete" SQL Injection [9.3 / Critical]
- WordPress Plugin "Super CAPTCHA Security Suite / Hardened 3D CAPTCHA" (super-captcha) SQL Injection [8.7 / High]
- WordPress Plugin "UPM Polls" SQL Injection [9.3 / Critical]
- WordPress Plugin "URL Redirect After Signing" Reflected XSS [5.3 / Medium]
- WordPress Plugin "VideoJS HTML5 Video Player" Flash XSS [5.3 / Medium]
- WordPress Plugin "WP DS FAQ" SQL Injection [9.3 / Critical]
- WordPress Plugin "WP Forum Server" (forum-server) SQL Injection via unsanitized input [9.3 / Critical]
- WordPress Plugin "WP Menu Creator" SQL Injection [9.3 / Critical]
- WordPress Plugin "WP Shortcodes" GitHub Button DOM XSS [5.3 / Medium]
- WordPress Plugin "WP Symposium" SQL Injection [9.3 / Critical]
- WordPress Plugin "wpForo Forum" SQL Injection [9.3 / Critical]
- WordPress Plugin WP Stream Unauthenticated Export [6.9 / Medium]
- WordPress Remote Login Open Redirect [5.3 / Medium]
- WordPress mgl-instagram-gallery Reflected XSS [5.3 / Medium]
- WordPress wp-license.php Backdoor [8.7 / High]
- vBulletin RouteString Local File Inclusion [8.7 / High]
- CVE-2003-0587: Ultimate Bulletin Board XSS [6.3 / Medium]
- DEOS AG OPENview Admin Panel Unauthenticated Access [9.3 / Critical]
- Gzip Archive Exposure [6.3 / Medium]
- Gzip Database Exposure [6.3 / Medium]
- Joomla! Directory Listing [6.9 / Medium]
- PHP Stack Trace [6.9 / Medium]
- Pendo API Key Exposure [6.9 / Medium]
- PrestaShop Log Exposure [6.9 / Medium]
- Prometheus Metrics Exporter [6.9 / Medium]
- Prometheus Metrics Exposure [6.9 / Medium]
- Ruby Bundler Gemfile.lock Exposure [6.9 / Medium]
- TYPO3 Temp Directory Listing [6.9 / Medium]
- Visual Studio Code FTP Synchronization Configuration Disclosure [6.9 / Medium]
- WordPress Directory Listing [6.9 / Medium]
- WordPress Full Path Disclosure [6.9 / Medium]
- WordPress Registration Enabled [9.3 / Critical]
- WordPress Unfinished Install [9.1 / Critical]
Thanks for your feedback