51167 matches found
EUVD-2026-91989
In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...
CVE-2018-16763
CVE-2018-16763 Fuel CMS 1.4.1 - Remote Code Execution - Python 3.x Original Script : Exploit-DB...
Pluck-Exploitation-by-skdevils
Pluck-Exploitation-by-skdevils Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Date: 13.03.2022 Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965...
CVE-2025-15467
CVE-2025-15467: OpenSSL CMS AuthEnvelopedData Stack Buffer Overflow Overview CVE-2025-15467 is a critical stack buffer overflow vulnerability in OpenSSL's CMS Cryptographic Message Syntax parsing code. The vulnerability exists in the evpciphergetasn1aeadparams function when processing AES-GCM...
CVE-2020-29607
CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution Authenticated CVE description: A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality,...
CVE-2018-12596
CVE-2018-12596 Ektron CMS 9.20 SP2 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local admins. Exploit-DB publication at...
CVE-2021-38699-Stored-XSS
CVE-2021-38699: Stored XSS in TastyIgniter v3.0.7 Restaurtant CMS Stored authenticated cross-site scripting exists in the in TastyIgniter v3.0.7 Restaurtant CMS System Logs section of the web application. https://vulners.com/cve/CVE-2021-38699 POC 1. Execute reflective cross site scripting...
CVE-2021-38699-Reflected-XSS
CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Admin dashboard start param: POST http://cvefarm.local/admin/dashboard HTTP/1.1...
CVE-2025-2304-POC
CVE-2025-2304 PoC - Camaleon CMS Privilege Escalation A Proof of Concept PoC exploit for CVE-2025-2304 , a critical mass assignment vulnerability in Camaleon CMS that allows privilege escalation from low-privileged users to administrators. ██████╗ ██████╗ ██╗ ██╗███╗ ██╗ ██████╗ ███╗ ███╗██╗...
CVE-2023-50564_Pluck-v4.7.18_PoC
CVE-2023-50564 PoC This repository contains a Proof of Concept for CVE-2023-50564 vulnerability in Pluck CMS version 4.7.18 Description CVE-2023-50564 is a vulnerability that allows unauthorized file uploads in Pluck CMS version 4.7.18. This exploit leverages a flaw in the module installation...
CVE-2023-23752
CVE-2023-23752 Joomla Unauthorized Access Vulnerability fofa: product="Joomla" Usage usage: CVE-2023-23752.py -h -u URL -f FILE -t THREAD -T TIMEOUT -o OUTPUT optional arguments: -h, --help show this help message and exit -u URL, --url URL Target urle.g. url.txt -f FILE, --file FILE Target filee....
CVE-2021-46365
CVE-2021-46365: Unsafe XML Parsing in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Requirements...
CVE-2019-19609
Strapi CMS Exploit This exploit targets two vulnerabilities in the Strapi CMS Framework version 3.0.0-beta-17.4 allowing for unauthenticated remote code execution RCE. Vulnerabilities CVE-2019-18818 Weak Password Recovery Mechanism for Forgotten Password CVSS : 9.8 - Critical More details:...
JoomlaScan
Joomla Scan A free and open source software to find the components installed in Joomla CMS, built out of the ashes of Joomscan. Features Scanning the Joomla CMS sites in search of components/extensions database of more than 600 components; Locate the browsable folders of component Index of ...;...
CVE-2023-41425
CVE-2023-41425 Description A Cross Site Scripting vulnerability in Wonder CMS Version 3.2.0 to Version 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This is a modifed version of the original exploit by prodigiousMind which...
CVE-2026-48909
CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...
tko-subs
tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...
CVE-2023-41425-wonderCMS_RCE
CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. For educational purposes only Requires knowledge of loginURL, admin access or the...
CVE-2026-8337
CVE-2026-8337 CVE-2026-8337 is an Insecure Direct Object Reference IDOR vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 which involved Express associations, this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey unde...