CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Плагин Modular DS для WordPress Неавторизованный доступ к администратору Proof-of-Concept PoC , демонстрирующий CVE-2026-23550 — критическую уязвимость неавторизованного захвата учётной записи администратора в плагине Modular DS для WordPress версии ≤2.5.1...

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Автор: Subhodeep Baroi CVE-2024-40119: CSRF-уязвимость в маршрутизаторе Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 Описание CVE-2024-40119 — это уязвимость межсайтовой подделки запроса CSRF в прошивке v2.0.1 маршрутизатора Nepstech Wifi Router xpon NTPL-XPON1GFE...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Обход аутентификации до захвата учётной записи администратора Описание : Burst Statistics 3.4.0 - 3.4.1.1 - Обход аутентификации до захвата учётной записи администратора Плагин Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative дл...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 — это уязвимость повышения привилегий CVSS 8.8, High с аутентификацией Agent+ в плагине LatePoint – Calendar Booking Plugin. CVE-2026-6741 — Сканер повышения привилегий LatePoint Плагин: LatePoint – плагин календарного бронирования для встреч и событий latepoint CVE ID...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Бюллетень безопасности: неаутентифицированный сохранённый межсайтовый скриптинг XSS, приводящий к захвату учётной записи администратора openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 — сохранённый XSS через поле имени пользователя при неудачном входе Назначенный идентификатор CVE:...

CVE-2023-32707

CVE-2023-32707 Un POC amélioré basé sur le CVE signalé sur exploitdb Exploit Title: Splunk 9.0.5 - Prise de contrôle du compte administrateur CVE: CVE-2023-32707 Vue d'ensemble Ce script permet d'exploiter une vulnérabilité dans Splunk 9.0.5, conduisant à une prise de contrôle du compte...

CVE-2025-50363_BXSS_CVE

Nome del progetto e URL del repository: Maid Hiring Management System using PHP and MySQL Tipo di vulnerabilità: Escalation dei privilegi tramite Blind XSS Versionei interessatae: v1.0 💣Descrizione della vulnerabilità: È stata scoperta una vulnerabilità di Blind Cross-Site Scripting XSS nel Maid...

CVE-2021-40101

XSS nei sondaggi combinato con CSRF porta al takeover dell'account amministratore in Concrete5 8.5.4 Un amministratore di Concrete CMS nelle versioni precedenti alla 9 non doveva fornire la propria password quando cambiava la password di un altro utente. In combinazione con CVE-2021-28145 "Concre...

CVE-2025-14340

XSS per appropriazione dell'account admin CVE-2025-14340 Una vulnerabilità di Cross-Site Scripting nell'Interfaccia REST di Amministrazione di Payara permette l'esecuzione di JavaScript controllato dall'attaccante, portando all'appropriazione dell'account admin. A causa di: 1. Il pannello utilizz...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...