CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Burst Statistics Authentifizierungsumgehung -brightgreen.svg?style=for-the-badge !CAUTION KRITISCHER HINWEIS: Diese Schwachstelle ermöglicht es einem nicht authentifizierten entfernten Angreifer , die Authentifizierung zu umgehen und volle Administratorrechte auf der...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2025-34077

CVE-2025-34077 Dirottamento di sessione admin non autenticato - Plugin Pie Register ≤ 3.7.1.4 📌 Descrizione Questo exploit sfrutta una vulnerabilità nel plugin Pie Register per WordPress versioni ≤ 3.7.1.4, consentendo il dirottamento di sessione non autenticato di account admin. 🛡️ Questo...

CVE-2021-40101

XSS nei sondaggi combinato con CSRF porta al takeover dell'account amministratore in Concrete5 8.5.4 Un amministratore di Concrete CMS nelle versioni precedenti alla 9 non doveva fornire la propria password quando cambiava la password di un altro utente. In combinazione con CVE-2021-28145 "Concre...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus Uno script PoC per CVE-2026-38526, RCE tramite una vulnerabilità di caricamento file nell'endpoint /admin/tinymce/upload di webkul krayin 2.2.x costruito per htb-nexus 🛠 Avvio rapido e utilizzo 1. Clona il repository: root@kitploit: git clone...

Make-and-Break

Make-and-Break Crea e sfrutta una macchina virtuale vulnerabile Descrizione: Creata una macchina virtuale personalizzata, con Ubuntu 18.04.1 e Webmin 1.810. Utilizzo di CVE-2019-15107 per sfruttare una backdoor nell'interfaccia di amministrazione del sistema Linux PROVA DI CONCETTO --- Il sistema...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Iniezione di oggetti PHP non autenticata Descrizione Il plugin Lis Video Gallery per WordPress è vulnerabile all'iniezione di oggetti PHP nelle versioni fino alla 0.2.1 inclusa, tramite deserializzazione di input non attendibili. Ciò consente a attaccant...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Nicht authentifizierte beliebige Shortcode-Ausführung Beschreibung: Das MDTF – Meta Data and Taxonomies Filter Plugin für WordPress ist in allen Versionen bis einschließlich 1.3.3.4 anfällig für die Ausführung beliebiger...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

By-Poloss..-..CVE-2026-10580

CVE-2026-10580: Hippoo Mobile App per WooCommerce = 1.9.4 - Bypass dell'autenticazione non autenticata per compromissione admin Non autenticato → Compromissione account amministratore tramite bug di confluenza logica 📌 Riepilogo...

CVE-2026-71927

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

CVE-2026-71929

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to...

CVE-2026-71919

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input ...