CVE-2021-38602

CVE-2021-38602 Una vulnerabilidad de cross site scripting almacenado está presente en la página de edición de artículos de la versión 5.8.7 de PluXML. La entrada del usuario no se sanitiza correctamente en varios campos. Campos vulnerables: Título opcional: Contenido: Una vez insertado, el XSS...

CVE-2024-22939

objetivo:https://github.com/sunkaifei/FlyCms versión: v1.0 Se descubrió que FlyCms v1.0 contiene una Cross-Site Request Forgery CSRF a través del componente /system/article/categoryedit Poc root@kitploit: history.pushState'', '', '/' Éxito:...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Dirección del proyecto: Preparación: Iniciar sesión en el backend - obtener cookie URL de la vulnerabilidad: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Parámetro vulnerable: keyword payload:...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...

service-now

service-now Bruteforcer de artículos de Service-Now La idea aquí es que existe una mala configuración en los artículos que podría exponer información sensible. Cualquier problema, repórtalo aquí - https://github.com/RandomRobbieBF/service-now/issues o envía un PR! Cómo usar root@kitploit: python3...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager tiene una inyección SQL ciega basada en tiempo en el módulo de precios de artículos Descripción general...

CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

CVE-2026-77034

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034

CVE-2026-77034 affects the Joomla Event Manager extension (versions prior to 5.0.1 ). The vulnerability allows an unauthenticated visitor holding their own session token to republish and overwrite an article associated with an event, resulting in an integrity impact rated Low (CVSS 4.0 score: 6.9...

EUVD-2026-66865

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75049

JetBrains YouTrack (versions before 2026.1.13903 and 2026.2.17950) has an authorization flaw: an authenticated user with low privileges can use the draft creation endpoint to read restricted articles from other projects, causing high confidentiality impact (CVSS 6.5). No in-the-wlood exploitation...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

EUVD-2026-54963

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375 dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375

CVE-2026-19375 affects dmitriiweb article-scraper-mcp 1.0.0. The vulnerability is in the function fetch_article (file: news_scraper_mcp/server.py); manipulating the argument url results in server-side request forgery . Attack can be performed remotely and the exploit is public. The reports note t...

CVE-2026-19375 dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...