CVE-2026-30862

CVE-2026-30862 PoC - Appsmith における権限昇格 Appsmith における保存型 XSS を介した権限昇格の Proof-of-Concept 開示情報: GHSA-5hw4-whxv-6794 を介して私が最初に報告しました ⚠️ 許可されたペネトレーションテスト/研究目的のみで使用してください。 脆弱性情報 フィールド| 値 ---|--- CVE ID| CVE-2026-30862 深刻度| 🔴 Critical CVSS スコア| 9.1 CVSS ベクター| CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H...

CVE-2026-7089-XSS

home-service-system-unauth-stored-xss-admin-takeover 취약점 세부 정보...

smartermail-CVE-2026-23760-poc

SmarterMail-CVE-2026-23760-poc SmarterMailシステム管理者アカウントのパスワードリセットAPIを介した認証バイパスを悪用する概念実証（PoC）です。 脆弱性 この脆弱性は、パスワードリセットAPIにおける認証バイパスに起因します。force-reset-passwordエンドポイントは匿名リクエストを許可し、システム管理者アカウントをリセットする際に既存のパスワードやリセットトークンを検証しません。 システム管理者アカウントの乗っ取り。 SmarterMailの組み込み機能を介したリモートコード実行への直接的な経路。 影響を受けるバージョン...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings WordPress Service Finder Bookings ≤ 6.0 플러그인의 인증 우회 취약점을 위한 익스플로잇 도구 📋 목차 취약점 정보 기술 세부사항 설치 사용법 예제 결과 보안 참고 자료 🔴 취약점 정보 CVE-2025-5947 Service Finder Bookings WordPress 플러그인 ...

CVE-2026-17526 Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-17526

CVE-2026-17526 is a privilege escalation vulnerability in Keycloak (open-source identity and access management), specifically in the keycloak-services component. A user holding the impersonation role can impersonate a realm administrator , gaining full administrative control over the realm—includ...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2023-51119

CVE-2023-51119 D-Link DIR-605L 라우터의 부적절한 접근 제어 취약점 설명: 부적절한 접근 제어로 인해, 특정 상황에서 인증 없이 요청을 보내 관리자 계정을 탈취할 수 있습니다 정당한 관리자가 로그인되어 있기만 하면 됨 실제로, 웹 설정 패널에서 수행 가능한 모든 라우터 작업관리자 비밀번호 변경 포함을 수행할 수 있으며, 이는 계정 탈취로 이어집니다. 이 익스플로잇은 라우터의 관리자 사용자에 대해 임의의 비밀번호를 설정하는 전체 과정을 자동화합니다. Happy hacking : 공개 타임라인:...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Эксплойт для CVE-2022-22845 — Неавторизованный захват администратора в QXIP SIPCAPTURE Homer-App до версии 1.4.27 Обнаружение: Omri Baso & Fabien Aunay Автор эксплойта: Omri Baso...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — SiYuan MCP 인증 없이 관리자 권한 탈취 CVE-2026-66012 CVSS 10.0 Critical에 대한 개념 증명PoC입니다. SiYuan의 MCPModel Context Protocol 엔드포인트에서 누락된 권한 부여 취약점으로, Publish 서버가 익명 모드로 활성화되어 있을 때 인증되지 않은 공격자가 관리자 권한을 탈취하고 원격 코드 실행을 달성할 수 있습니다. 취약점 요약 필드| 값 ---|--- CVE| CVE-2026-66012 CVSS 3.1| 10.0 Critical...

CVE-2025-65427

CVE-2025-65427: Проблема ограничения скорости аутентификации в Dbit N300 T1 Pro Идентификатор CVE: CVE-2025-65427 Дата: 2025-12-16 Обнаружил: Kirubel Продукт: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Версия прошивки: V1.0.0 Описание Проблема обнаружена в маршрутизаторе Dbit N300 T1 Pro...

cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — JFrog Artifactory 인증 우회 → 관리자 탈취 CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · 2026-08-28 공개 · 실제 공격에서 악용됨. 인증되지 않은 네트워크 인접 공격자가 기본 자체 호스팅 JFrog Artifactory에 대해 플랫폼 관리자 액세스 토큰 을 발급합니다. 이 디렉터리에는 재현 가능한 Docker 랩과 URL 매개변수화된 검증 PoC가 포함되어 있습니다. artifactory-oss 7.161.19취약,...

CVE-2025-48932-Invision-Community-SQLi-Exploit

🔓 CVE-2025-48932 — эксплойт SQL-инъекции в Invision Community ⚡ Обзор критической уязвимости CVE-2025-48932 — это критическая неаутентифицированная слепая SQL-инъекция , обнаруженная в Invision Community версиях ≤ 4.7.20. Этот эксплойт позволяет удалённым злоумышленникам: 🔍 Извлекать...

CVE-2026-18111

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-18111

CVE-2026-18111 is a stored XSS in Concrete CMS affecting the Feature, Feature Link, Hero Image, and Image blocks in versions before 9.5.3 (and before 8.5.21 in the 8.x line). The root cause is that external link URLs were insufficiently validated by the link filter and rendered without output esc...

CVE-2026-91930 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2026-91995

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...

CVE-2026-91995 pig before 4.1.0 Unverified Password Change via /register/password

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account...