735 matches found
Login Configurator <=2.1 - Cross-Site Scripting
Login Configurator WordPress plugin = 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL. id:...
Arcserve UDP <= 9.0.6034 - Authentication Bypass
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. This session can be used to execute a...
CVE-2025-34157
Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...
CVE-2023-41425-RCE-WonderCMS-4.3.2
🚨 Herramienta de Explotación RCE de WonderCMS CVE-2023-41425 Esta herramienta ofensiva de seguridad basada en Python automatiza la explotación de una vulnerabilidad de Ejecución Remota de Código RCE en WonderCMS 4.3.2 , específicamente CVE-2023-41425. Simplifica el proceso de crear un módulo de...
CVE-2026-84024
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin (WordPress) before 1.2.2 fails to verify a CSRF nonce before saving its meta field configuration. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, resulting in an unauth...
CVE-2026-89255
AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The root cause is a failure to HTML-encode PGP public keys before echoing them into a element. An authenticated attacker can submit a crafted public ...
EUVD-2026-75419
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the ADServer plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter,...
CVE-2024-10924
CVE-2024-10924 - Authentication Bypass in Really Simple Security OVERVIEW This project demonstrates the exploitation and mitigation of CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress "Really Simple Security" plugin. STEP 1: ENVIRONMENT SETUP Start the vulnerable...
CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...
EUVD-2026-74566
The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...
CVE-2025-41646
CVE-2025-41646 - RevPi Webstatus = 2.4.5 Authentication Bypass Exploit Overview This is a Python3 exploit script for CVE-2025-41646 , an Authentication Bypass vulnerability affecting RevPi Webstatus = 2.4.5. Vulnerability Details: CVE ID : CVE-2025-41646 Affected Product : RevPi Webstatus = 2.4.5...
CVE-2026-66917
IDOR + XSS almacenado mediante autorización rota a nivel de objeto en JoomGallery JoomGallery ≤ 4.3.0 — Un usuario con rol Editor secuestra cualquier imagen de la galería y almacena una carga XSS, lo que permite tomar el control de la sesión del administrador RESUMEN UserimageController::save en...
CVE-2026-2991
KiviCare = 4.1.2 - Authentication Bypass CVE-2026-2991 PoC 📜 Description CVE-2026-2991 is an authentication bypass vulnerability in the KiviCare – Clinic & Patient Management System EHR WordPress plugin affecting all versions up to and including 4.1.2. The plugin exposes a public REST endpoint at...
CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
CVE-2026-85181
CAT (dianping/cat) through 3.1.0 is vulnerable to session cookie forgery due to using Java String.hashCode as the sole integrity check without a server-side secret key. An attacker can compute valid checksums offline and, by setting the x-forwarded-for header, bypass IP-binding validation to crea...
EUVD-2026-70485
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...
CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...
CVE-2026-77850
Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...
CVE-2026-55779
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...