CVE-2026-79663 Ech0 before 4.7.3 Stored XSS via RSS feed tag names

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

EUVD-2026-65451

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

CVE-2026-79663 Ech0 before 4.7.3 Stored XSS via RSS feed tag names

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686-La-Peculiarita-del-Protocollo-TCP-IP-Che-Apre-i-Cancelli Una vulnerabilità critica di RCE nello stack TCP/IP di Windows CVE-2025-26686 lascia memoria sensibile sbloccata, consentendo a un attaccante remoto di dirottare i sistemi. Sfruttabile attraverso la rete, rischia la...

cve-2026-34472-auth-bypass-zte-h188a-router

CVE-2026-34472 Technische Analyse von CVE-2026-34472, einem Auth-Bypass durch durchgesickerte Anmeldedaten, die die Firmware ZTE ZXHN H188A V6 betreffen. Zusammenfassung In den getesteten H188A V6-Builds können nicht authentifizierte Anfragen an den Stammpfad auf Pre-Login-Wizard-Handler zugreife...

cve-2021-21735-zte-zxhn-h168n-admin-compromise

CVE-2021-21735: ZTE ZXHN H168N Informationsleck bis zur vollständigen Administratorübernahme Technische Fallstudie und für GitHub Pages bereite Ausarbeitung zu CVE-2021-21735 im ZTE ZXHN H168N V3.5. Dieses Repository konzentriert sich auf den Firmware-Routing-Fehler hinter den offengelegten...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF über SVG-Bild-Upload Übersicht Sicherheitslücke zur Server-Side Request Forgery SSRF in ThingsBoard IoT-Plattform-Versionen vor 4.2.1. Ein Angreifer mit Tenant-Admin-Zugriff kann eine manipulierte SVG-Datei mit einer internen URL-Referenz über die...

bw-dump

BW-Dump Update 2 : Dieser Schwachstelle wurde CVE-2023-38840 zugewiesen. Update : Ein Patch wurde im GitHub-Pull-Request 5813 veröffentlicht, der die Schwachstelle behebt. Die betroffenen Versionen sind Bitwarden Desktop 2023.7.0 und älter. Beschreibung Ein Proof-of-Concept-Tool, das das...

proofpoint-CVE-2023-0089

Über Sicherheitsforscher: ly1g3, ly1g3attuta.io GPG-Fingerabdruck: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Überblick: Remote Code Execution – Von einem niedrig privilegierten authentifizierten Benutzer zu Admin-RCE CVE: CVE-2023-0089 Zeitleiste:...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — Escalation dei privilegi WordPress Esplorazione pratica di una vulnerabilità critica in WordPress utilizzando il plugin WooCommerce Payments. 📌 Riepilogo La CVE-2023-28121 consente di creare utenti amministratori senza autenticazione tramite API REST. Severità: Critica CVSS 9.8...

CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Execução Remota de Código Autenticada Este repositório contém um exploit funcional para CVE-2021-44967 , uma vulnerabilidade de Execução Remota de Código autenticada no LimeSurvey. 🎯 Compatibilidade Testado e confirmado funcionando em: LimeSurvey 5.2.x LimeSurvey...

EUVD-2026-65358

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.5 . An unauthenticated attacker can elevate their privileges to that of an administrator , resulting in a CVSS 3.1 base score of 9.8 (CRITICAL) with full impact on confidentialit...

CVE-2019-19511

CVE-2019-19511 Chevereto - 1.0.0 Free - 1.1.4 Free, = 3.13.4 Core, Esecuzione di codice remoto Descrizione installer.php in Chevereto fino alla versione 1.1.4 Free e fino alla 3.13.4 Core consente agli amministratori autenticati in remoto di eseguire codice PHP arbitrario iniettando questo codice...

CVE-2026-77134

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

CVE-2014-3704

Code-Konvertierung zu Python 3 Dieser Code stammt aus "Drupal 7.0 7.31 - 'Drupalgeddon' SQL Injection Add Admin User" und wurde in Python 3 konvertiert, um für die Übung in Academy für das Modul "Attacking Commoon Applications" und den Abschnitt "Attacking Drupal" zu passen. Der ursprüngliche Cod...

EUVD-2026-65354

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-12878

CVE-2026-12878 affects the Codefresh platform , where an authenticated user can leverage an API endpoint to escalate privileges to Admin . The CVSS 4.0 score is 8.6 (HIGH) , with high impact on confidentiality, integrity, and availability of the vulnerable system. Attack requires high privileges ...