EUVD-2026-92630

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Settings Change vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.9...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

CVE-2026-102776

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

EUVD-2026-92451

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2021-46074

CVE-2021-46074 익스플로잇 제목: Vehicle Service Management System - 'Settings' 저장형 크로스 사이트 스크립팅XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIUM 참고 자료: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

CVE-2022-43271

CVE-2022-43271 저장된 크로스 사이트 스크립팅 XSS 제품: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software 발견 날짜: 2/8/2022 수정 날짜: 4/8/2022 영향 받는 버전: 버전 4, 빌드 260 수정된 버전: 버전 4, 빌드 261 설명: 이 취약점은 CRM의 '직원 설정' 중 '프로필' 텍스트 상자에서 발견되었습니다. 변경 사항을 저장하고 POST 요청을 가로챌 때 'lProfileCopy' 매개변수를 수정하여 XSS 페이로드를 포함시키고...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...

CVE-2022-28598

ERPNext - 12.29.0 ERPNext 12.29.0의 'My Setting' 페이지에서 발견된 "lastknownversion" 필드의 저장형 교차 사이트 스크립팅XSS 취약점을 통해 원격 공격자는 인증된 POST HTTP 요청을 '/deskForm/User/Authenticated User'로 보내 제작된 사이트 이름을 통해 임의의 웹 스크립트 또는 HTML을 주입할 수 있으며, 'pdf' 보기 양식을 클릭하여 스크립트를 볼 수 있는 'lastknownversion' 필드에 스크립트를 주입할 수 있습니다. 이 취약점...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: /settings 保存時のチェックボックス省略により API キー強制が静かに無効化される 製品: dgtlmoon/changedetection.io — v0.55.7 ファイル: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — 不適切なアクセス制御 CVSS 3.1: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L — 6.3 中 CNA: Turan...

CVE-2023-44487

CVE-2023-44487 — HTTP/2 Rapid Reset 테스트 랩 LTAT.04.022 과제 4를 위한 교육용 환경입니다. 네 개의 컨테이너로 취약한 구성과 패치된 구성을 스캔하고 비교할 수 있습니다. 포트 맵 컨테이너| 포트| 소프트웨어| 상태 ---|---|---|--- nginx-vuln| 8441| nginx 1.24| 취약 nginx-secure| 8442| nginx latest| 패치됨 apache-vuln| 8443| Apache 2.4.57| 취약 apache-secure| 8444| Apache...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 작성자: Sergio 설명: ConcreteCMS v.9.2.1의 크로스 사이트 스크립팅Cross Site Scripting 취약점으로 인해 로컬 공격자가 Page Settings의 SEO - Extra 항목에 조작된 스크립트를 삽입하여 임의 코드를 실행할 수 있습니다. 공격 벡터: "SEO"의 "Header Extra Content" 입력값 검증 부재로 인해 사용자가 웹 페이지에 접속할 때 실행되는 JavaScript 코드를 삽입할 수 있습니다. PoC: 패널에 로그인한...

PT-2026-106143

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-106011

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-28648: Undefined Security Weakness

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

chef-os-hardening

os-hardening Chef cookbook 1 2 説明 このcookbookは、数多くのセキュリティ関連設定を提供し、全体的な基本保護を実現します。 以下の設定を行います: パッケージ管理の設定（例: 署名済みパッケージのみを許可） 既知の問題があるパッケージの削除 pam および pamlimits モジュールの設定 Shadow password suite の設定 システムパス権限の設定 ソフトリミットによるコアダンプの無効化 システムコンソールへのrootログインの制限 SUIDの設定 sysctlによるカーネルパラメータの設定 以下のことは行いません:...

CVE-2023-49984

CVE-2023-49984 School Fees Management System v1.0 - "/management/settings"의 "name" 필드/매개변수에서의 XSSCross-Site Scripting 취약점 설명 : School Fees Management System v1.0의 "/management/settings" 구성 요소에서 발견된 XSSCross-Site Scripting 취약점으로, 공격자가 name 매개변수에 삽입된 조작된 페이로드를 통해 임의의 웹 스크립트 또는 HTML을 실행할 수 있습니다. 취약한...