packages_apps_Settings_CVE-2020-0201

इस रिपॉजिटरी में README नहीं है।...

CVE-2022-35649

CVE-2022-35649 पेलोड जनरेटर पायथन 2 का उपयोग करके और CVE-2022-35649 के लिए विस्तृत विश्लेषण पायथन में PoC जब GhostScript 9.50 के 0-day के लिए शोषण किया जाता है तो पेलोड उत्पन्न करता है। यह 0-day शोषण Ubuntu रिपॉजिटरी से डिफ़ॉल्ट सेटिंग्स के साथ ImageMagick को प्रभावित करता है Ubuntu 20.04 पर...

CVE-2024-2782-PoC

CVE-2024-2782-PoC إثبات المفهوم لثغرة CVE-2024-2782 إضافة نموذج الاتصال Contact Form من Fluent Forms لمُنشئ نماذج WordPress للاختبارات والاستطلاعات والسحب والإفلات معرّضة لتعديل غير مصرح به للبيانات بسبب عدم وجود فحص للصلاحيات على نقطة نهاية REST API /wp-json/fluentform/v1/global-settings في جميع...

Packages_app_settings_CVE-2020-0201

لا يحتوي هذا المستودع على ملف README...

TP-L-NK-SIZMA-EXPLO-T

TP-LiNK-SIZMA-EXPLOiT TP-Link Router Authenticated RCE Exploit CVE-2022-30075 यह उपकरण TP-Link Archer AX50 और कुछ अन्य TP-Link राउटर मॉडलों में पाए जाने वाले CVE-2022-30075 सुरक्षा दोष का उपयोग करके प्रमाणीकृत दूरस्थ कमांड निष्पादन Authenticated Remote Code Execution करता है। TP-Link Router...

CVE-2025-10377

CVE-2025-10377 का प्रूफ ऑफ कॉन्सेप्ट: प्लगइन सिस्टम डैशबोर्ड में क्रॉस-साइट अनुरोध जालसाजी CSRF फ़ंक्शन sdtogglelogs भेद्यता प्रकार: क्रॉस-साइट अनुरोध जालसाजी CSRF प्रभावित फ़ंक्शन: sdtogglelogs CVSS v3.1: 4.3 मध्यम वेक्टर: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N नोट: स्कोर अनधिकृत स्थिति परिवर्तन को...

CVE-2026-104119

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

EUVD-2026-92073

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

EUVD-2026-92051

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129: Incorrect Authorization

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-104119: Undefined Security Weakness

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

PT-2026-104606

Name of the Vulnerable Software and Affected Versions Simple Shopping Cart WordPress plugin versions prior to 5.2.6 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to escape certain settings field values before they are displayed on the admin settings page. This allows...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129

LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...