CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS nella funzionalità di creazione di post del blog in Amasty Blog Pro per Magento 2 Descrizione La funzionalità di creazione di post del blog nel plugin Amasty Blog Pro 2.10.3 per Magento 2 consente l'iniezione di codice JavaScript nei campi shortcontent e...

CVE-2022-35501

CVE-2022-35501 Cross-site Scripting XSS memorizzato nella funzionalità di creazione dei post del blog in Amasty Blog Pro per Magento 2 Descrizione La funzionalità di creazione dei post nel plugin Amasty Blog Pro 2.10.3 e 2.10.4 per Magento 2 consente l'iniezione di codice JavaScript nel campo...

CVE-2019-18818_CVE-2019-19609

Exploit per CVE-2019-18818 e CVE-2019-19609 Questo repository contiene uno script Python per sfruttare due vulnerabilità: CVE-2019-18818 e CVE-2019-19609. CVE-2019-18818 Questa vulnerabilità consente a un attaccante di reimpostare la password di un utente amministratore nel CMS Strapi. Utilizzo 1...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

PT-2026-81273

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-81177

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.4.3 Description An issue exists that allows unauthenticated attackers to elevate their privileges to those of an administrator. Recommendations Update Jawn to a version newer than 1.4.2...

PT-2026-81911

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

Ricognizione e Sfruttamento: Vulnerabilità del Server HTTP Apache - CVE-2021-41773 e CVE-2021-42013 In questo progetto, ho documentato un processo dettagliato di penetration testing mirato alle vulnerabilità del server HTTP Apache, in particolare CVE-2021-41773 e CVE-2021-42013, che coinvolgono...

CVE-2021-39409

CVE-2021-39409 O registro de conta de administrador é possível no Online Student Rate System v1.0, permitindo que um ator malicioso crie uma conta de administrador e acesse o painel de administração. Vulnerabilidade root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent:...

CVE-2022-23378

CVE-2022-23378 : XSS riflesso in TastyIgniter v3.2.2 CMS per ristoranti Nella dashboard Admin di TastyIgniter versione v3.2.2 è presente una XSS riflessa autenticata. URL Mitre: https://vulners.com/cve/CVE-2022-23378 URL NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-23378 Prova di concetto POC:...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Burst Statistics Authentifizierungsumgehung -brightgreen.svg?style=for-the-badge !CAUTION KRITISCHER HINWEIS: Diese Schwachstelle ermöglicht es einem nicht authentifizierten entfernten Angreifer , die Authentifizierung zu umgehen und volle Administratorrechte auf der...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2025-34077

CVE-2025-34077 Dirottamento di sessione admin non autenticato - Plugin Pie Register ≤ 3.7.1.4 📌 Descrizione Questo exploit sfrutta una vulnerabilità nel plugin Pie Register per WordPress versioni ≤ 3.7.1.4, consentendo il dirottamento di sessione non autenticato di account admin. 🛡️ Questo...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...