CVE-2023-22432

CVE-2023-22432 web2pyの脆弱性（CVE-2023-22432）のPoC検証 web2py の脆弱性（CVE-2023-22432）が2023年1月31日（米国時間）に公開されました。この記事では、この脆弱性に関する検討と検証結果について説明します。 脆弱性の概要 この脆弱性は、web2pyのオープンリダイレクト脆弱性であり、管理ページのURLにおいてコールバック先URLとして任意のURLを指定できます。もともとオープンリダイレクト対策は実装されていましたが、URLに特別なバイパス手法を適用することで再現されます。これにより、悪意のあるサイトに誘導される可能性があります...

Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting. id: CVE-2022-0899 info: name: Header Footer Code Manager 1.1.24 - Cross-Site Scripting author:...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

Next.js-Middleware-Bypass-CVE-2025-29927-

概要 @zhero の個人ブログ記事を読んだ後、どうやって動くのかを学ぶためにこのCTFを構築することにしました。その後、この脆弱性の悪用方法を学びたい人なら誰でも共有できるようにしました。zhero と inzo に多大な感謝を捧げます。彼らのブログ記事はこちらにあります: "https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" 目標 ミドルウェアをバイパスして管理ページのフラグを見つける必要があります。また、素晴らしいAssetnoteの研究...

vulnerability-in-Remix-React-Router-CVE-2025-31137-

概要 私は @zhero の個人ブログ記事の writeup を読んだ後、仕組みを学ぶためにこの CTF を作成することにしました。その後、この脆弱性の悪用を学びたい人なら誰でも共有できるようにすることにしました。[email protected] バージョンで CTF を作成しようとしましたが、@remix-run/express を確認したところ、コードが修正されていることに気付きました。そこで、脆弱性のあるコードを彼らの GitHub からコピー＆ペーストしました。以下の指示に従って、@remix-run/express パッケージのコードを変更する必要があります。 目標...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

CVE-2025-15694

Joli Table Of Contents WordPress plugin (versions 2.0.0–2.8.0 ) contains a Stored XSS vulnerability caused by insufficient sanitisation and escaping of plugin settings before output on an admin page. This allows high-privilege users (Admin+) to inject scripts that persist even when the unfiltered...

EUVD-2025-210850

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

CVE-2025-15694 Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

PT-2026-86317

🚨 CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltere...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin (before 4.4.8) reflects unescaped query-string parameters on an admin page, enabling reflected XSS against administrators who click a crafted link. CISA SSVC reports no active exploitation. Update to version 4.4.8 to remediate.

CVE-2026-11920

CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...

CVE-2025-15677

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-68583

Luci-app-adblock-fast prior to 1.2.4-4 contains a stored XSS in the blocklist name field. When an administrator views the AdBlock Fast status page, the payload executes in the administrator’s browser under the LuCI origin. Affected version is 1.2.4-3 and earlier; upgrade to 1.2.4-4 or later to re...

EUVD-2026-51867

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-67352

CVE-2026-67352 affects luci-app-https-dns-proxy. A stored XSS flaw exists in the resolver_url parameter; authenticated users can inject active HTML, which is rendered as raw HTML on the HTTPS DNS Proxy status page and can execute JavaScript in the admin’s browser origin. Documents provide CVSS me...