nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 작성자: Subhodeep Baroi CVE-2024-40119: Nepstech Wifi Router NTPL-XPON1GFEVN v1.0의 CSRF 취약점 설명 CVE-2024-40119 은는 Nepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 펌웨어 v2.0.1의 CSRF교차 사이트 요청 위조 취약점입니다. 이 취약점을 통해 원격 공격자는 사용자의 동의 없이 관리자 비밀번호를 변경하여 잠재적인 계정 탈취로 이어질 수 있습니다...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPressプラグイン 認証なし管理者アクセス 概念実証（PoC） - CVE-2026-23550 を実証します。これは Modular DS WordPressプラグイン （バージョン≤2.5.1）における重大な認証なし管理者アカウント乗っ取りです。実環境で活発に悪用されています。 攻撃概要 : /api/modular-connector/login の欠陥のあるREST APIルーティングが、origin=mo...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

보안 권고: 무인증 저장형 크로스 사이트 스크립팅으로 인한 관리자 계정 탈취 openclaw-dashboard 제목: OpenClaw Dashboard v3.0.0 실패한 로그인 사용자 이름 필드를 통한 저장형 XSS 할당된 CVE ID: CVE-2026-66418 대상 저장소: https://github.com/tugcantopaloglu/openclaw-dashboard 요약 로그인 엔드포인트는 제출된 사용자 이름을 검증 없이 감사 로그에 기록합니다. 알림 패널은 이후 해당 로그 항목을 읽어 innerHTML로 이스케이프 ...

CVE-2023-32707

CVE-2023-32707 An improved POC exploit based on the reported CVE on exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Overview This script allows for exploiting a vulnerability in Splunk 9.0.5, leading to admin account takeover. The exploit leverages a low-privile...

CVE-2025-50363_BXSS_CVE

Nome del progetto e URL del repository: Maid Hiring Management System using PHP and MySQL Tipo di vulnerabilità: Escalation dei privilegi tramite Blind XSS Versionei interessatae: v1.0 💣Descrizione della vulnerabilità: È stata scoperta una vulnerabilità di Blind Cross-Site Scripting XSS nel Maid...

CVE-2021-40101

XSS nei sondaggi combinato con CSRF porta al takeover dell'account amministratore in Concrete5 8.5.4 Un amministratore di Concrete CMS nelle versioni precedenti alla 9 non doveva fornire la propria password quando cambiava la password di un altro utente. In combinazione con CVE-2021-28145 "Concre...

CVE-2025-14340

XSS per appropriazione dell'account admin CVE-2025-14340 Una vulnerabilità di Cross-Site Scripting nell'Interfaccia REST di Amministrazione di Payara permette l'esecuzione di JavaScript controllato dall'attaccante, portando all'appropriazione dell'account admin. A causa di: 1. Il pannello utilizz...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...