CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.5 . An unauthenticated attacker can elevate their privileges to that of an administrator , resulting in a CVSS 3.1 base score of 9.8 (CRITICAL) with full impact on confidentialit...

EUVD-2026-65358

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-77134

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

CVE-2014-3704

Code-Konvertierung zu Python 3 Dieser Code stammt aus "Drupal 7.0 7.31 - 'Drupalgeddon' SQL Injection Add Admin User" und wurde in Python 3 konvertiert, um für die Übung in Academy für das Modul "Attacking Commoon Applications" und den Abschnitt "Attacking Drupal" zu passen. Der ursprüngliche Cod...

EUVD-2026-65354

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-12878

CVE-2026-12878 affects the Codefresh platform , where an authenticated user can leverage an API endpoint to escalate privileges to Admin . The CVSS 4.0 score is 8.6 (HIGH) , with high impact on confidentiality, integrity, and availability of the vulnerable system. Attack requires high privileges ...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 ist anfällig für eine falsche Zugriffskontrolle in admin-head-updates.php Ein nicht authentifizierter Angreifer kann eine Schwachstelle zur Lokalen Dateieinbindung Local File Inclusion im GET-Parameter 'lang' ausnutzen. Durc...

CVE-2026-77134

CVE-2026-77134 is a Broken Access Control vulnerability in the TYPO3 extension femanager . The extension fails to require the dedicated admin confirmation token when processing an admin-approval request. Instead, a regular user confirmation hash—obtainable by any visitor through the public resend...

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are...

CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentifizierungsumgehung 🔎 Überblick CVE-2025-2825 ist eine kritische Schwachstelle zur Authentifizierungsumgehung, die CrushFTP betrifft, einen weit verbreiteten sicheren Dateiübertragungsserver. Der Fehler ermöglicht es entfernten Angreifern, die...

CVE-2022-1386-FusionBuilder-SSRF

CVE-2022-1386 – Fusion Builder Esempio: root@kitploit: python3 exploitcve20221386.py https://vulnerable.site https://abc123.oast.fun Usa Interact.sh o Burp Collaborator per ricevere il callback. 📋 Output di esempio root@kitploit: Fetching nonce from target... Sending SSRF payload to...

CVE-2025-59718-PoC

Wizard di Exploit CVE-2025-59718 Panoramica Questo strumento è uno script proof-of-concept PoC per CVE-2025-59718, una vulnerabilità critica di bypass dell'autenticazione nei prodotti Fortinet ad es. FortiOS, FortiProxy, FortiSwitchManager dovuta a una verifica impropria delle firme crittografich...

CVE-2026-78477

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Proof of Concept di Iniezione di Comandi Descrizione della vulnerabilità: Le funzioni ping e traceroute del router NETIS SYSTEMS WF2409E versione V3.6.42541 sono suscettibili ad attacchi di iniezione di comandi. Input malevoli possono esse...

CVE-2026-78477 Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

CVE-2025-47550

Instantio - Plugin Wordpress 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2026-45156-POC

Glitch Matrice Hacker 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me Bypass della Firma JWT Proof of Concept PoC completamente automatizzato per l'acquisizione dell'admin. 📖 La Storia Dietro ogni CVE c'è una storia. Questa è stata trovata alle 2 di notte in una fredda notte d'inverno, alimentata da...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection nel parametro sSortDir0 - v3.5.2 - v4.5.4. Oltre alla possibilità per un amministratore di sfruttare questa vulnerabilità, può essere utilizzata anche in un attacco CSRF per indurre un utente amministratore a eseguire query dannose. File interessati...