CVE-2022-38813

CVE-2022-38813 Escalada de privilegios vertical a través del parámetro user en Blood Donor Management System Using Codeigniter v 1.0 Descripción técnica: Blood Donor Management System 1.0 no restringe adecuadamente el acceso a admin/dashboard.php, lo que permite a los atacantes acceder a todos lo...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Múltiples XSS Reflejados en TastyIgniter v3.0.7 Restaurtant CMS Existe XSS reflejado autenticado en el panel de administración de TastyIgniter en la versión 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Parámetro start del panel de administración: POST...

cve-2026-23550-poc

CVE-2026-23550 PoC Un pequeño probador en Bash para CVE-2026-23550. Solicita el endpoint de inicio de sesión del conector modular de WordPress afectado, verifica si se emite una cookie wordpressloggedin e intenta confirmar el acceso al panel de administración. Advertencia: Utilice esta herramient...

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or...

CVE-2026-93659-writeup

CVE-2026-93659: XSS Almacenado en Concrete CMS Community Store Conduce a la Toma de Control del Panel de Administración Resumen | ---|--- CVE| CVE-2026-93659 Componente| concretecms-community-store/communitystore Tipo| Cross-Site Scripting Almacenado CWE-79 Severidad| CVSS v4.0 9.3 Crítica / v3.1...

CVE-2026-25595

CVE-2026-25595 — XSS Almacenado a través del Número de Factura en InvoicePlane 1.7.0 Vulnerabilidad: Cross-Site Scripting XSS Almacenado a través del campo Número de Factura Producto: InvoicePlane Versión Afectada: 1.7.0 y probablemente versiones anteriores Gravedad: Media Puntuación CVSS 3.1: 4....

CVE-2026-7401-XSS

XSS Almacenado en CET Automated Grading System — Registro de Estudiantes Sin Autenticación → Panel de Administración Detalles Campo| Valor ---|--- Vendedor| SourceCodester URL del Vendedor| https://www.sourcecodester.com Producto| CET Automated Grading System con AI Predictive Analytics en PHP y...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - PoC de RCE Este repositorio contiene el Proof of Concept PoC para la vulnerabilidad de Ejecución Remota de Código RCE no autenticada en EITS Admin Dashboard v2.4.0 CVE-2026-31367. La vulnerabilidad se debe a una falla en la sanitización de entradas ...

CVE-2025-65271

CVE-2025-65271 PoC para CVE-2025-65271 ¿Cómo ejecutar? node server.js Descripción La inyección de plantillas del lado del cliente CSTI en el panel de administración de Azuriom CMS permite a un usuario con pocos privilegios ejecutar código de plantilla arbitrario en el contexto de la sesión de un...

CVE-2026-100608

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

CVE-2026-100608

Flowise versions through 3.1.4 contain an authorization bypass in the BullMQ admin dashboard . When running in queue mode with the dashboard enabled (and not in cloud mode), the /admin/queues mount fails to perform role, permission, or workspace scoping checks because it only validates the JWT vi...

EUVD-2026-87703

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

CVE-2025-13533

The CSS & JavaScript Toolbox WordPress plugin (all versions up to and including 12.0.6 ) is vulnerable to Stored Cross-Site Scripting via the Assignment Engine fields. The root cause is insufficient input sanitization and output escaping on assignment data fields including Expressions , URLs , an...

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

EUVD-2026-71012

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589: Missing Authorization

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...