CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb con versione 6.1.2.0 o precedente contiene una vulnerabilità di Remote Code Execution RCE nella funzionalità Notification Settings. Un attaccante autenticato con privilegi "System Settings" in ASWeb può sfruttare questa falla per eseguire comandi...

CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

A permission bypass vulnerability exists in Settings due to a confused deputy flaw. This issue allows for local escalation of privilege without requiring additional execution privileges or user interaction. No specific software version, exploit links, or remediation steps are provided in the docu...

CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92630

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Settings Change vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.9...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

CVE-2026-102776

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

EUVD-2026-92451

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2021-46074

CVE-2021-46074 Titolo dell'exploit: Vehicle Service Management System - 'Impostazioni' Cross Site Scripting XSS persistente Autore dell'exploit: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIO Riferimenti:...

CVE-2022-43271

CVE-2022-43271 Cross-Site Scripting Memorizzato XSS Prodotto: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software Data di scoperta: 2/8/2022 Data di correzione: 4/8/2022 Versione interessata: version 4, build 260 Versione corretta: version 4, build 261 Descrizione: La vulnerabilità è...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...

CVE-2022-28598

ERPNext - 12.29.0 Vulnerabilità di cross-site scripting XSS memorizzato nel campo "lastknownversion" presente nella pagina "My Setting" in ERPNext 12.29.0 che consente a utenti remoti di iniettare script web o HTML arbitrari tramite un nome di sito modificato, effettuando una richiesta HTTP POST...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: la casella di controllo omessa nel salvataggio di /settings disattiva silenziosamente l'applicazione della chiave API Prodotto: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 —...

CVE-2023-44487

CVE-2023-44487 — Laboratorio di test HTTP/2 Rapid Reset Ambiente didattico per il compito 4 di LTAT.04.022. Quattro container ti permettono di scansionare e confrontare configurazioni vulnerabili e patchate. Mappa delle porte Container| Porta| Software| Stato ---|---|---|--- nginx-vuln| 8441| ngi...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Autor: Sergio Beschreibung: Cross-Site-Scripting-Schwachstelle in ConcreteCMS v.9.2.1 ermöglicht es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript in den SEO-Extra-Einstellungen der Seitenkonfiguration auszuführen. Angriffsvektoren: Eine...

PT-2026-106011

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...