CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Argomenti Richiesti: -u, --url URL del sito WordPress target es. http://127.0.0.1/wordpress -e, --email Email per il nuovo account amministratore Argomenti Opzionali: -f, --fname Nome predefinito: Pwn -l, --lname Cognome predefinito: Admin -r, --role Ruolo da...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Escalation di privilegi senza autenticazione 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Escalation di privilegi senza autenticazione 📌 Panoramica Questo repository contiene un tool proof-of-concept in Python per CVE-2025-39459 , che colpisce il tema WordPress...

PT-2026-106179

Name of the Vulnerable Software and Affected Versions Ghost versions 5.37.0 through 6.66.0 Description A crafted request to the external media inliner can lead to excessive CPU usage, resulting in the server becoming unresponsive. This issue requires Administrator access to be exploited...

EUVD-2026-92783

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

CVE-2026-95263: Undefined Security Weakness

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

PT-2026-106208

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the delete-team-member RPC where a team administrator can remove any member except themselves, but the system fails to protect the team owner. This allows a non-owner administrator...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

CVE-2026-102776: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

PT-2026-106180

Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.66.0 Description A crafted content import file can lead to excessive CPU usage, resulting in the Ghost server becoming unresponsive. This issue requires Administrator access to be exploited. Recommendations Updat...

PT-2026-106224

Name of the Vulnerable Software and Affected Versions Feehi CMS version 2.1.1 Description Incorrect Access Control allows a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account. This occurs because the server...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control (CWE-284). A low-privilege backend administrator possessing administrator-update permissions can modify the password of the built-in super administrator account. This is possible because the server fails to enforce protections for the supe...

PT-2026-104727

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

PT-2026-106209

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description In the create-team-invitations and invitation acceptance paths, a non-owner team administrator can assign the owner role to another account. This occurs because invitation roles are persisted and...

CVE-2026-76581-Detector

CVE-2026-76581 - Rilevatore di Vulnerabilità WPMU DEV Dashboard Un rilevatore Python sicuro e passivo per identificare installazioni WordPress che eseguono una versione di WPMU DEV Dashboard affetta da CVE-2026-76581. Il rilevatore non sfrutta il bypass dell'autenticazione, non richiede né...

CVE-2021-44228---detection-with-PowerShell

Rilevamento di CVE-2021-44228 con PowerShell 1 Apri automatedscan.ps1, imposta la variabile $ResultsCSV e $Directory 2 Salva e chiudi il file 3 Apri PowerShell come amministratore ed esegui il seguente comando: powershell.exe -noprofile -executionpolicy bypass -file .\automatedscan.ps1...

CVE-2023-0156

CVE-ID : CVE-2023-0156 Schwachstellentyp : Directory Traversal Beschreibung : Das All-In-One Security AIOS-Plugin für WordPress ist in Versionen bis einschließlich 5.1.4 anfällig für Directory Traversal. Dies ermöglicht authentifizierten Angreifern mit Administratorberechtigungen, den Inhalt...

CVE-2025-6934

CVE-2025-6934 🛡️ CVE-2025-6934 - Escalation dei Privilegi non Autenticata in Opal Estate Pro 📝 Descrizione Il plugin Opal Estate Pro – Property Management and Submission per WordPress, utilizzato dal tema FullHouse - Real Estate Responsive WordPress Theme, è vulnerabile all'Escalation dei Privileg...

wp2shell-Hestia-Scanner

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Scanner di sicurezza WordPress in sola lettura per server HestiaCP. Rileva gli indicatori di compromissione wp2shell su tutti i siti ospitati — con report email per cliente, diff dei file del core, rilevamento webshell SHA256, punteggio di rischio...