Lucene search
+L

314 matches found

Kitploit
Kitploit
added 2026/09/14 3:57 a.m.7 views

CVE-2025-14340

XSS para la toma de control de la cuenta de administrador CVE-2025-14340 Una vulnerabilidad de Cross-Site Scripting en la interfaz REST de administración de Payara permite la ejecución de JavaScript controlado por el atacante, lo que provoca la toma de control de la cuenta de administrador. Esto ...

9.3CVSS5.9AI score0.01002EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 5:40 p.m.7 views

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Autor: Subhodeep Baroi CVE-2024-40119: Vulnerabilidad CSRF en el enrutador WiFi Nepstech NTPL-XPON1GFEVN v1.0 Descripción CVE-2024-40119 es una vulnerabilidad de Cross-Site Request Forgery CSRF en el enrutador WiFi Nepstech xpon NTPL-XPON1GFEVN v1.0 con firmwar...

8.8CVSS6.1AI score0.00495EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 12:54 p.m.7 views

CVE-2023-32707

CVE-2023-32707 Un exploit POC mejorado basado en el CVE reportado en exploitdb Título del Exploit: Splunk 9.0.5 - Toma de Control de Cuenta de Administrador CVE: CVE-2023-32707 Resumen Este script permite explotar una vulnerabilidad en Splunk 9.0.5, que lleva a la toma de control de una cuenta de...

8.8CVSS7.9AI score0.79019EPSS
SaveExploits7
Kitploit
Kitploit
added 2026/09/12 5:26 p.m.6 views

CVE-2025-50363_BXSS_CVE

Nombre del Proyecto y URL del Repositorio: Sistema de Gestión de Contratación de Empleadas Domésticas usando PHP y MySQL Tipo de Vulnerabilidad: Escalada de Privilegios mediante XSS Ciego Versiónes Afectadas: v1.0 💣Descripción de la Vulnerabilidad: Se descubrió una vulnerabilidad de Cross-Site...

5.4CVSS5.7AI score0.00234EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 2:05 p.m.8 views

CVE-2021-40101

Encuesta XSS combinada con CSRF conduce a la toma de control de cuenta de administrador en Concrete5 8.5.4 Un administrador de Concrete CMS en versiones anteriores a la 9 no tenía que proporcionar su contraseña al cambiar la contraseña de otro usuario. En combinación con CVE-2021-28145 "Concrete...

7.2CVSS6.7AI score0.02555EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/10 12:55 a.m.8 views

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress Plugin Unauthenticated Admin Access Proof-of-Concept PoC demonstrating CVE-2026-23550 - critical unauthenticated admin account takeover in Modular DS WordPress plugin versions ≤2.5.1. Actively exploited in the wild. Attack Summary : Flawed...

9.8CVSS6.2AI score0.21687EPSS
SaveExploits9
Cvelist
Cvelist
added 2026/09/09 6:44 p.m.33 views

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS0.00282EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/08 6:39 p.m.9 views

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Omisión de autenticación para apropiación de cuenta de administrador Descripción : Burst Statistics 3.4.0 - 3.4.1.1 - Omisión de autenticación para apropiación de cuenta de administrador El plugin Burst Statistics – Privacy-Friendly WordPress Analytics Google...

9.8CVSS6AI score0.14608EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/08 7:42 a.m.5 views

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

9.3CVSS5.9AI score0.00511EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/08 7:32 a.m.6 views

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 es una vulnerabilidad de escalada de privilegios autenticada, Agent+ con puntuación CVSS 8.8 Alta en el plugin LatePoint – Calendar Booking Plugin. CVE-2026-6741 — Escáner de escalada de privilegios LatePoint Plugin: LatePoint – Calendar Booking Plugin for Appointments...

8.8CVSS6AI score0.00293EPSS
SaveExploits1
NVD
NVD
added 2026/09/01 5:17 a.m.9 views

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

8.8CVSS0.00396EPSS
SaveExploits0References12
EUVD
EUVD
added 2026/08/26 3:39 a.m.10 views

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

9.8CVSS5.4AI score0.02493EPSS
SaveExploits4References10
EUVD
EUVD
added 2026/08/24 2:51 p.m.10 views

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS5.9AI score0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 2:51 p.m.48 views

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS0.00216EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/21 8:16 a.m.14 views

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

9.8CVSS0.00568EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/21 7:39 a.m.72 views

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

9.8CVSS5.5AI score0.00568EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/19 5:39 p.m.40 views

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS0.00374EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/19 5:39 p.m.14 views

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS5.9AI score0.00374EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 6:00 a.m.15 views

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

8.1CVSS5.3AI score0.00248EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/18 8:47 p.m.13 views

GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

8.7CVSS6AI score0.00382EPSS
SaveExploits0References4
Rows per page
Query Builder