PT-2026-104563

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 XSS a RCE, Wonder CMS 3.2.0 = 3.4.2 Uso ➜ CVE-2023-41425 python3 exploit.py Enter target URL RHOST, e.g., http://example.com/loginURL: http://redacted.com/loginURL Enter your local host IP LHOST, e.g., 10.10.14.xxx: xx.xx.xx.xx Enter your local web server port...

CVE-2026-104476 Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

CVE-2026-104476

Backdrop CMS versions prior to 1.35.1 are susceptible to an information disclosure vulnerability. This flaw allows unauthenticated attackers to retrieve configuration export archives that remain on the server after a transfer is completed. By downloading these compressed archives, an attacker can...

CVE-2026-104476 Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

CVE-2026-104476 Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Exploit de Zip Slip RCE en Xibo CMS CVE-2023-33177 Este exploit demuestra una vulnerabilidad de path traversal en Xibo CMS CVE-2023-33177 que permite la ejecución remota de código mediante importaciones maliciosas de diseños. Detalles de la vulnerabilidad CVE/Aviso: CVE-2023-33177 Versiones...

CVE-2025-25967

CVE-2025-25967: Falsificación de Petición en Sitios Cruzados CSRF DDSN Interactive cm3 Acora CMS versión 10.1.1 es vulnerable a la Falsificación de Petición en Sitios Cruzados CSRF. Esta falla permite a los atacantes engañar a usuarios autenticados para que realicen acciones no autorizadas, como ...

CVE-2020-25790

CVE-2020-25790 Entorno de vulnerabilidad de carga de archivos de Typesetter CMS Método de descarga docker pull mtwf/typesettercve-2020-25790:5.1 docker run -it -d -p 80:80 mtwf/typesettercve-2020-25790:5.1 /bin/bash -c "service apache2 start;/bin/bash" Las credenciales de Typesetter son admin:adm...

weaponised-XSS-payloads

Payloads de XSS armados Payloads XSS diseñados para convertir alert1 en un P1. La entrada del blog Este repositorio se publicó junto con un artículo de blog titulado "How to Upgrade Your XSS Bugs from Medium to Critical" https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4...

DEVVORTEX

DEVVORTEX HackTheBox: Devvortex — Resolución de la Máquina Un recorrido técnico exhaustivo que detalla el compromiso de la máquina Devvortex en HackTheBox. Esta ruta demuestra Fuzzing de Subdominios , Enumeración de la API de Joomla , Modificación de Plantillas para el acceso inicial, Extracción ...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Escalada de Privilegios por Asignación Masiva PoC Vulnerabilidad de escalada de privilegios en Camaleon CMS /updatedajax con passwordrole=admin inyectado en los parámetros de contraseña. 4. Verifica que el rol se haya actualizado a admin. Requisitos Python 3 Instalar...

CVE-2025-32432-PoC

CVE-2025-32432: Herramienta de Explotación de Envenenamiento de Registros a RCE Descripción Este repositorio contiene un exploit de prueba de concepto PoC profesional escrito en Go, diseñado para demostrar una cadena de vulnerabilidades crítica en Craft CMS. El exploit aprovecha una vulnerabilida...

CVE-2026-28695-craft-rce-bypass

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RCE element-search CVSS 3.x : 8.8 HIGH approx — verify CWE : CWE-502 Unsafe Object Instantiation + CWE-1336 SSTI origin Base : CVE-2026-28695 SSTI via create + Symfony Process Fix : advisory fix e31e508 restricts create to BaseObject —...

CVE-2026-63573

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2018-16763

Analizador CVE-2018-16763 CVE-2018-16763 Analyzer es un pequeño proyecto de Python para analizar CVE-2018-16763 contra objetivos FUEL CMS. Se centra en verificar si un objetivo parece vulnerable y en mostrar la salida de comandos de forma más limpia y legible cuando la respuesta de la aplicación ...

CVE-2026-63578

The bc-csharp library (versions before 2.7.0 ) by Legion of the Bouncy Castle Inc. is vulnerable to a denial of service via CPU exhaustion in the PbeUtilities.GenerateCipherParameters function. This is caused by the allocation of resources without limits during password-based private-key decrypti...

CVE-2026-63573

A Bleichenbacher-style adaptive chosen-ciphertext attack exists in Legion of the Bouncy Castle Inc. bc-csharp versions before 2.7.0 . The vulnerability is located in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) component. Because the system rejects ciphert...

CVE-2026-63573 Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

EUVD-2026-91224

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...