939 matches found
CVE-2025-65271
CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...
WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion
WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or...
CVE-2021-38699-Reflected-XSS
CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Admin dashboard start param: root@kitploit: POST http://cvefarm.local/admin/dashboard...
CVE-2022-38813
CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...
cve-2026-23550-poc
CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...
Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...
CVE-2026-93659-writeup
CVE-2026-93659：Concrete CMS Community Store 中的存储型 XSS 导致管理员仪表盘被接管 摘要...
CVE-2025-13533
The CSS & JavaScript Toolbox WordPress plugin (all versions up to and including 12.0.6 ) is vulnerable to Stored Cross-Site Scripting via the Assignment Engine fields. The root cause is insufficient input sanitization and output escaping on assignment data fields including Expressions , URLs , an...
CVE-2026-25595
CVE-2026-25595 — XSS Almacenado a través del Número de Factura en InvoicePlane 1.7.0 Vulnerabilidad: Cross-Site Scripting XSS Almacenado a través del campo Número de Factura Producto: InvoicePlane Versión Afectada: 1.7.0 y probablemente versiones anteriores Gravedad: Media Puntuación CVSS 3.1: 4....
CVE-2026-7401-XSS
CET 自动化评分系统中的存储型 XSS — 学生注册（未认证 → 管理员仪表盘） 详细信息 字段| 值 ---|--- 供应商| SourceCodester 供应商 URL| https://www.sourcecodester.com 产品| 基于 PHP 和 MySQL 的 CET 自动化评分系统（含 AI 预测分析） 产品 URL| https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html 版本| 1.0 漏洞类...
EITS-Portal-Exploit-CVE-2026-31367-PoC
💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC 此仓库包含针对 EITS Admin Dashboard v2.4.0 （CVE-2026-31367）中未认证的远程代码执行（RCE）漏洞的概念验证（PoC）。 该漏洞源于 /api/v1/debug 端点在输入清理方面的缺陷，攻击者可通过混淆的 payload 在服务器上注入并执行任意命令。 ⚠️ 法律声明（免责声明） 此脚本的创建严格用于教育和研究目的 。在未经事先双方同意的情况下，使用此工具攻击目标是非法的。作者不承担任何责任，也不对因使用本程序造成的任何滥用或损害负责。...
CVE-2026-85589
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...
CVE-2026-78364
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...
EUVD-2026-68158
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...
CVE-2026-78364
CVE-2026-78364 affects the MW WP Form WordPress plugin in versions prior to 5.1.6 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by failure to sanitize and escape form settings before outputting them in an admin dashboard page, specifically via the Inquiry Data List . An authen...
CVE-2026-15604
The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...
CVE-2026-15604
The CVE-2026-15604 entry concerns the Toocheke Companion WordPress plugin. It describes a Stored Cross-Site Scripting (Stored XSS) flaw in versions up to 2.10, caused by insufficient input sanitization in toocheke_series_bg_color_save() (stores raw $_POST in post meta) and inadequate output escap...
EUVD-2026-59893
The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...
PT-2026-73107
The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series bg color' post meta field. This is due to insufficient input sanitization in the toocheke series bg color save function which stores the raw $ POST value...
