937 matches found
CVE-2026-47761
👋 नमस्ते ! सुरक्षा अनुसंधान 🛡️ CVE-2026-47761 – सुरक्षा शोधकर्ता प्रकार : Stored Cross-Site Scripting XSS उत्पाद : TinyMCE संदर्भ : CVE : https://nvd.nist.gov/vuln/detail/CVE-2026-47761 GHSA : https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w सम्मान सूची CVE-2026-47761...
CVE-2026-38526-PoC
CVE-2026-38526 | Krayin CRM v2.2.x Authentifizierte RCE - Uneingeschränkter PHP-Datei-Upload über TinyMCE Beschreibung CVE-2026-38526 ist eine kritische authentifizierte Remote-Codeausführungs-Schwachstelle, die Webkul Krayin CRM v2.2.x betrifft. Die Schwachstelle existiert im...
Moodle - Cross-Site Scripting/Remote Code Execution
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...
CVE-2021-37787
CVE-2021-37787: Iniezione SQL in ABOCMS tramite modulo TinyMCE Dettagli della vulnerabilità CVE ID : CVE-2021-37787 Prodotto : ABOCMS Versioni interessate : 5.8.x, ≤5.9.3 Tipo di vulnerabilità : Iniezione SQL Punteggio CVSS : 9.8 Descrizione Una vulnerabilità critica di iniezione SQL è presente i...
CVE-2026-38526-PoC-htb-nexus
CVE-2026-38526-PoC-htb-nexus Ein PoC-Skript für CVE-2026-38526, RCE über eine Datei-Upload-Schwachstelle im /admin/tinymce/upload-Endpunkt von webkul krayin 2.2.x gebaut für htb-nexus 🛠 Schnellstart und Verwendung 1. Repository klonen: root@kitploit: git clone...
CVE-2019-3396
CVE-2019-3396 Vulnerabilità RCE non autenticata in Confluence CVE-2019-3396 Insidia: in alcune versioni è necessario aggiungere l'header Referer per avere successo Lettura file root@kitploit: POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: 10.10.20.181 User-Agent: Mozilla/5.0 Windows NT 10.0;...
CVE-2026-38526-POC
CVE-2026-38526 - Exploit RCE per Krayin CRM Krayin CRM ≤ 2.2.x - Caricamento file senza restrizioni che porta all'esecuzione remota di codice. Questo PoC sfrutta l'endpoint vulnerabile di upload di TinyMCE /admin/tinymce/upload per caricare una webshell PHP e ottenere l'esecuzione di comandi sul...
PoC-CVE-2026-38526
CVE-2026-38526 - Upload PHP RCE no Krayin CRM Exploit automatizado para Krayin CRM ≤ 2.2.x. Este script explora uma vulnerabilidade de upload de arquivo irrestrito no endpoint TinyMCE /admin/tinymce/upload, contorna a validação do tipo MIME falsificando image/jpeg, faz upload de um webshell PHP e...
CVE-2026-38526
CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...
KrayinCRM-RCE-Exploit-CVE-2026-38526
🔓 Krayin CRM v2.2.x - Exploração de Execução Remota de Código Autenticada ⚠️ APENAS PARA TESTES DE SEGURANÇA AUTORIZADOS - O uso não autorizado é ilegal e antiético. 📋 Visão Geral Esta ferramenta de exploração demonstra uma vulnerabilidade crítica de execução remota de código RCE autenticada...
CVE-2026-72743
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...
CVE-2026-72743 SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...
CVE-2026-72743
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...
EUVD-2026-55801
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...
CVE-2026-72743
SQLBot 1.10.0 contains a stored XSS in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. If an attacker can modify the dashboard text widget, they can inject arbitrary HTML/JavaScript that executes for all dashboard viewers. The issue is fixed in commit c...
CVE-2026-72743 SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...
CLSA-2026-1781052744 TuxCare security update for tinymce (4 CVEs)
TuxCare rebuilt tinymce to address 4 CVEs. Fixed in 6.8.6-tuxcare.4...
CVE-2026-65535
Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...