CVE-2025-14340

XSS pour prise de contrôle du compte administrateur CVE-2025-14340 Une vulnérabilité de Cross-Site Scripting dans l’interface d’administration REST de Payara permet l’exécution de JavaScript contrôlé par un attaquant, conduisant à une prise de contrôle du compte administrateur. En raison de : 1. ...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Contournement d'authentification menant à une prise de contrôle du compte administrateur Description : Burst Statistics 3.4.0 - 3.4.1.1 - Contournement d'authentification menant à la prise de contrôle du compte administrateur Le plugin Burst Statistics –...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 est une vulnérabilité d'élévation de privilèges Authenticated Agent+ avec un score CVSS de 8,8 High dans le LatePoint – Calendar Booking Plugin CVE-2026-6741 — Scanner d'élévation de privilèges LatePoint Plugin : LatePoint – Calendar Booking Plugin for Appointments and...

CVE-2025-50363_BXSS_CVE

اسم المشروع وعنوان المستودع: نظام إدارة توظيف الخادمات باستخدام PHP و MySQL نوع الثغرة: تصعيد الصلاحيات عبر XSS غير المرئية Blind XSS الإصدار المتأثر: v1.0 💣وصف الثغرة: تم اكتشاف ثغرة من نوع Cross-Site Scripting غير المرئية Blind XSS في نظام إدارة توظيف الخادمات، والتي تسمح لمستخدم عادي مثل خادمة...

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Auteur : Subhodeep Baroi CVE-2024-40119 : Vulnérabilité CSRF dans le routeur Wifi Nepstech NTPL-XPON1GFEVN v1.0 Description CVE-2024-40119 est une vulnérabilité de type Cross-Site Request Forgery CSRF dans le routeur Wifi Nepstech xpon NTPL-XPON1GFEVN v1.0 avec...

CVE-2021-40101

حقن XSS في الاستبيان مع CSRF يؤدي إلى الاستيلاء على حساب المسؤول في Concrete5 8.5.4 لم يكن مسؤول Concrete CMS في الإصدارات الأقل من 9 بحاجة إلى تقديم كلمة المرور الخاصة به عند تغيير كلمة مرور مستخدم آخر. بالاشتراك مع CVE-2021-28145 "Concrete CMS المعروف سابقًا بـ concrete5 قبل الإصدار 8.5.5 يسمح...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2023-32707

CVE-2023-32707 استغلال POC محسّن يعتمد على CVE المبلغ عنها على exploitdb عنوان الاستغلال: Splunk 9.0.5 - السيطرة على حساب المسؤول CVE: CVE-2023-32707 نظرة عامة يسمح هذا السكريبت باستغلال ثغرة أمنية في Splunk 9.0.5، مما يؤدي إلى السيطرة على حساب المسؤول. يستغل هذا الاستغلال مستخدمًا ذا صلاحيات...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Avis de sécurité : Cross-Site Scripting stocké non authentifié menant à la prise de contrôle du compte administrateur openclaw-dashboard Titre : XSS stocké dans OpenClaw Dashboard v3.0.0 via le champ de nom d'utilisateur d'une connexion échouée Identifiant CVE attribué : CVE-2026-66418 Dépôt cibl...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-73847

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...