CVE-2026-65930 LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5...

CVE-2026-65930

LimeSurvey Community Edition 7.0.5 is affected by an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog within the administrative question editor. An attacker with low privileges can inject a persistent script that executes in the context of other users who i...

CVE-2023-5965

PoC per Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Avviso Un utente autenticato con privilegi potrebbe caricare un file zip appositamente predisposto sul server EspoCRM nella versione 7.2.5, tramite il modulo di aggiornamento, che potrebbe portare all'esecuzione di codice PHP...

CVE-2024-21683-RCE

CVE-2024-21683-RCE Danksagungen https://x.com/realalphaman https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated Nutzung root@kitploit: git clone https://github.com/W01fh4cker/CVE-2024-21683-RCE cd CVE-2024-21683-RCE pip install requests bs4 python CVE-2024-21683.py -u...

CVE-2015-6967

CVE-2015-6967 python exploit.py --url http://xx.xx.xx.xx --username admin --password nibbles --payload phprevshell.php Ändere $ip in Zeile 7 von phprevshell.php nc -lvnp 1234...

CVE-2021-36747

CVE-2021-36747 Blackboard Learn bis 9.1 ermöglicht XSS durch einen authentifizierten Benutzer über das Formular „Feedback to Learner“. Entdeckt: 11. Mai 2018 Das Blackboard-Sicherheitsteam wurde über dieses Problem informiert. Es bestätigte die Schwachstelle am 14. Mai 2018. Beschreibung: Das...

CVE-2026-65646

CVE-2026-65646 is an improper neutralization of special elements vulnerability in Plesk 's DNS zone management functionality , allowing remote authenticated users to disclose arbitrary local files and escalate privileges. The CVSS 4.0 base score is 8.7 (HIGH) , with low privileges required, no us...

CVE-2026-65646

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65647

CVE-2026-65647 is an improper symlink resolution vulnerability in the Plesk Site Import and Migrator extensions. A remote authenticated (low-privilege) user can leverage this flaw to execute arbitrary code as root , resulting in full compromise of the vulnerable system. The CVSS 4.0 score is 8.7 ...

cve-2020-24572

CVE-2020-24572 Eine Schwachstelle wurde in includes/webconsole.php in RaspAP 2.5 entdeckt. Mit authentifiziertem Zugriff kann ein Angreifer eine fehlkonfigurierte und praktisch uneingeschränkte Webkonsole nutzen, um das zugrunde liegende Betriebssystem, auf dem diese Software läuft, anzugreifen u...

CVE-2026-62249

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Iniezione SQL post-autenticazione Exploit Title: WooCommerce Customers Manager 29.4 - Iniezione SQL post-autenticazione Data: 2024-03-25 Autore Exploit: Ivan Spiridonov - xbz0n Software Link:...

CVE-2023-36146

CVE-2023-36146 PoC di CVE-2023-36146 - Multilaser RE 170 Firmware 2.2.6733 Cross Site Scripting persistente autenticato Passaggi per riprodurre: 1. Accedi al dispositivo tramite il tuo browser web 2. Vai su Security IP Filtering 3. Nel campo "Description" inietta il payload "" 4. Fai clic su Add ...

CVE-2022-23046

CVE-2022-23046 La scoperta originale e il PoC manuale provengono da Fluidattacks: PhpIPAM v1.4.4 consente a un utente amministratore autenticato di iniettare istruzioni SQL nel parametro "subnet" durante la ricerca di una subnet tramite app/admin/routing/edit-bgp-mapping-search.php. Questo PoC...

CVE-2023-40028

Proof of Concept PoC für CVE-2023-40028 CVE-2023-40028 ist eine Schwachstelle in Ghost CMS, die durch unsachgemäße Dateiverarbeitung das beliebige Lesen von Dateien ermöglicht. Dieses PoC demonstriert, wie der Exploit unter kontrollierten Bedingungen funktioniert. Nur für Bildungszwecke. Referenz...

CVE-2022-24654

CVE-2022-24654 PoC di CVE-2022-24654 - INTELBRAS ATA 200 Firmware 74.19.10.21 Cross Site Scripting persistente autenticato Passaggi per riprodurre: 1. Accedere all'apparecchiatura tramite il browser web 2. Andare su Management Syslog 3. Nel campo "Field Server Address" iniettare il payload...

CVE-2020-9460

CVE-2020-9460 root@kitploit: ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Cross-Site-Scripting - Oempro Octech Oempro 4.7 bis 4.11 ermöglicht XSS durch einen authentifizierten Benutzer. Der...

CVE-2025-25706

CVE-2025-25706 وصف العنصر: root@kitploit: Product Vendor: freebsdbrasil Item: ProApps - Enterprise Appliance Editor Creator: DreamWeaver PHP: PHP Version 7.3.18 Java Script Library: Jquery UI 1.6 | Jquery 1.2.6 Server: NGINX Operational System: FreeBDS Unix نوع الثغرة: تنفيذ التعليمات البرمجية عن...

CVE-2023-49471

CVE-2023-49471 Tipo de Vulnerabilidade SSRF cego Produto e Versão Afetados Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0copyright" -------------...