314 matches found
nepstech-xpon-router-CVE-2024-40119
nepstech-xpon-router-CVE-2024-40119 ่่ : Subhodeep Baroi CVE-2024-40119: Nepstech Wifi Router NTPL-XPON1GFEVN v1.0ใซใใใCSRF่ๅผฑๆง ่ชฌๆ CVE-2024-40119 ใฏใNepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 ใใกใผใ ใฆใงใข...
CVE-2025-14340
XSSใซใใ็ฎก็่ ใขใซใฆใณใไนใฃๅใ CVE-2025-14340 Payaraใฎ็ฎก็RESTใคใณใฟใผใใงใผในใซใใใใฏใญในใตใคใในใฏใชใใใฃใณใฐใฎ่ๅผฑๆงใซใใใๆปๆ่ ใๅถๅพกใใJavaScriptใๅฎ่กใใใ็ฎก็่ ใขใซใฆใณใใฎไนใฃๅใใซใคใชใใใพใใ็็ฑใฏไปฅไธใฎ้ใใงใ๏ผ 1. ใใใซใฏHTTP Basic่ช่จผใไฝฟ็จใใฆใใพใ๏ผใใฉใฆใถใๅไธใชใชใธใณใชใฏใจในใใซๅฏพใใฆ่ชๅ็ใซ่ช่จผๆ ๅ ฑใ้ไฟกใใพใ๏ผใ 2. change-admin-passwordใจใณใใใคใณใใฏใใฆใผใถใผใฎใในใฏใผใใๆดๆฐใใ้ใซ็พๅจใฎใในใฏใผใใๅฟ ่ฆใจใใพใใใ 3...
CVE-2023-32707
CVE-2023-32707 exploitdb ใงๅ ฑๅใใใCVEใซๅบใฅใๆน่ฏใใใPOCใจใฏในใใญใคใ Exploit Title: Splunk 9.0.5 - ็ฎก็่ ใขใซใฆใณใใฎไนใฃๅใ CVE: CVE-2023-32707 ๆฆ่ฆ ใใฎในใฏใชใใใฏSplunk 9.0.5ใฎ่ๅผฑๆงใๆช็จใใ็ฎก็่ ใขใซใฆใณใใฎไนใฃๅใใๅฏ่ฝใซใใพใใใใฎใจใฏในใใญใคใใฏใedituser ๆฉ่ฝใๆใคไฝๆจฉ้ใฆใผใถใผใๅฉ็จใใฆๆจฉ้ใๆๆ ผใใใพใใ ๅๆๆกไปถ Python 3.x ๅฟ ่ฆใชPythonใใใฑใผใธ๏ผpip3 install -r requirements.txt ใงใคใณในใใผใซ๏ผ:...
CVE-2025-50363_BXSS_CVE
ใใญใธใงใฏใๅ & ใชใใธใใชURL: Maid Hiring Management System using PHP and MySQL๏ผPHPใจMySQLใไฝฟ็จใใใกใคใ้็จ็ฎก็ใทในใใ ๏ผ ่ๅผฑๆงใฟใคใ: ใใฉใคใณใXSSใซใใๆจฉ้ๆๆ ผ ๅฝฑ้ฟใๅใใใใผใธใงใณ:v1.0 ๐ฃ่ๅผฑๆงใฎ่ชฌๆ: Maid Hiring Management System ใซใใใฆใใใฉใคใณใXSSใฎ่ๅผฑๆงใ็บ่ฆใใใพใใใใใใซใใใไธ่ฌใฆใผใถใผ๏ผใกใคใใ้็จ่ ใชใฉ๏ผใๆจฉ้ใๆๆ ผใใใ็ฎก็่ ใขใซใฆใณใใไนใฃๅใๅฏ่ฝๆงใใใใพใใ ๐ฉโ๐ปๅฝฑ้ฟ:...
CVE-2021-40101
ใขใณใฑใผใXSSใจCSRFใฎ็ตใฟๅใใใซใใใConcrete5 8.5.4ใง็ฎก็่ ใขใซใฆใณใใไนใฃๅใใใ 9ใใๅใฎใใผใธใงใณใฎConcrete CMS็ฎก็่ ใฏใๅฅใฎใฆใผใถใผใฎใในใฏใผใใๅคๆดใใ้ใซ่ชๅใฎใในใฏใผใใๅ ฅๅใใๅฟ ่ฆใใใใพใใใงใใใ CVE-2021-28145๏ผใConcrete...
CVE-2026-23550-PoC
CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress ๆไปถ ๆช่ฎค่ฏ็ฎก็ๅ่ฎฟ้ฎ ๆฆๅฟต้ช่ฏ๏ผPoC๏ผ ๏ผๆผ็คบ CVE-2026-23550 - Modular DS WordPress ๆไปถ ๏ผ็ๆฌ โค2.5.1๏ผไธญ็ไธฅ้ๆช่ฎค่ฏ็ฎก็ๅ่ดฆๆทๆฅ็ฎกๆผๆดใๅทฒๅจ้ๅค่ขซ็งฏๆๅฉ็จใ ๆปๅปๆ่ฆ ๏ผ/api/modular-connector/login ไธญ็ผบ้ท็ REST API ่ทฏ็ฑๅจ origin=mo ๆถ็ป่ฟ WordPress ่ฎค่ฏ๏ผๆไบๆช่ฎค่ฏ็ฎก็ๅไผ่ฏ Cookieใ ๐ ๅฟซ้ๆผ็คบ - ๅฆๆๆจๅทฒ้ ็ฝฎๅฅฝ WP root@kitploit:...
CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...
CVE-2026-8181
CVE-2026-8181 Burst Statistics | ๆ้็ป่ฟ่ณ็ฎก็ๅ่ดฆๆทๆฅ็ฎก ๆ่ฟฐ๏ผ Burst Statistics 3.4.0 - 3.4.1.1 - ๆ้็ป่ฟ่ณ็ฎก็ๅ่ดฆๆทๆฅ็ฎก WordPress ๆไปถ Burst Statistics โ ้็งๅๅฅฝๅ WordPress ๅๆ๏ผGoogle Analytics ๆฟไปฃๅ๏ผๅจ 3.4.0 ๅฐ 3.4.1.1 ็ๆฌไธญๅญๅจ่บซไปฝ้ช่ฏ็ป่ฟๆผๆดใ่ฟๆฏ็ฑไบๅจ้ช่ฏๆฅ่ช Authorization ๅคด็ๅบ็จ็จๅบๅฏ็ ๆถ๏ผismainwpauthenticated ๅฝๆฐๅฏน่ฟๅๅผ็ๅค็ไธๆญฃ็กฎใ่ฏฅๅฝๆฐ่ฐ็จ...
CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field
ๅฎๅ จๅ ฌๅ๏ผๆช่ฎค่ฏ็ๅญๅจๅ่ทจ็ซ่ๆฌๅฏผ่ด็ฎก็ๅ่ดฆๆท่ขซๆฅ็ฎก๏ผopenclaw-dashboard๏ผ ๆ ้ข๏ผOpenClaw Dashboard v3.0.0 ้่ฟ็ปๅฝๅคฑ่ดฅ็็จๆทๅๅญๆฎตๅฎ็ฐๅญๅจๅ XSS ๅ้ ็ CVE ID๏ผCVE-2026-66418 ็ฎๆ ไปๅบ๏ผhttps://github.com/tugcantopaloglu/openclaw-dashboard ๆ่ฆ ็ปๅฝ็ซฏ็นๅจๆฒกๆไปปไฝ้ช่ฏ็ๆ ๅตไธ๏ผๅฐๆไบค็็จๆทๅ่ฎฐๅฝๅฐๅฎก่ฎกๆฅๅฟไธญใ้็ฅ้ขๆฟ้ๅไผ่ฏปๅ่ฟไบๆฅๅฟๆก็ฎ๏ผๅนถ้่ฟ innerHTML...
CVE-2026-6741
CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint โ Calendar Booking Plugin CVE-2026-6741 โ LatePoint Privilege Escalation Scanner Plugin: LatePoint โ Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...
CVE-2026-19806
The Support Genix โ Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...
EUVD-2026-66230
The TranslatePress โ Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...
EUVD-2026-64898
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-77264
The Automation Web Platform โ Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...
CVE-2026-77264
The Automation Web Platform โ Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions โค 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...
CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
EUVD-2026-62258
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...
GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover
Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...