CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

JFrog Artifactory < 7.146.27 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.27. It is, therefore, affected by a privilege escalation vulnerability in the refresh-token signature due to incorrect validation. An authenticated, remote attacker can...

PT-2026-118282

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

CVE-2024-56116

CVE-2024-56116 Suggested description A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account. Vulnerability Type CWE-352 | Cross-Site Request Forgery CSRF Vendor of Product Amiro.CMS https://www.amiro.ru Affected Product Code...

CVE-2026-12660

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2024-4412

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language EL code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges...

CVE-2024-4412 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language EL code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges...

EUVD-2024-55807

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language EL code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges...

CVE-2024-4412

Multiple WSO2 products are vulnerable to Expression Language (EL) injection because the software fails to sufficiently validate user-supplied data. This flaw allows an attacker with administrator privileges to inject malicious EL code and execute arbitrary operations within the affected deploymen...

EUVD-2026-104466

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-12660

The IBM MQ Web Console is vulnerable to a path traversal issue (CWE-22) caused by improper path validation . This flaw could allow an authenticated administrator to write files outside the intended directory. The CVSS 3.1 base score is 2.7 (Low) , with an integrity impact of low and no impact on ...

CVE-2026-12660 IBM MQ Path Traversal

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

EUVD-2026-104277

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296

The FlyCms content management system (through commit edfdf724 ) is vulnerable to a default credentials vulnerability. This flaw allows unauthenticated remote attackers to gain super administrator access by logging into the flycms account using the default password admin123 via a POST request to /...

WordPress Salon Booking System plugin 10.17-10.31.10 - Salon Staff+ Privilege Escalation to Administrator vulnerability

Salon Staff+ Privilege Escalation to Administrator vulnerability discovered by RIA Labs in WordPress Plugin Salon booking system versions 10.17-10.31.10...