CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · Summary · Root cause · Attack chain · Exploit · Remediation · Timeline 📋 At a glance |...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - XSS Reflejado a RCE Autor del Exploit: Bobby Cooke boku Estadísticas de Vulnerabilidad OWASP Top Ten 2017: A7:2017-Cross-Site Scripting XSS CWE-79: Neutralización incorrecta de la entrada durante la generación de páginas web 'Cross-site Scripting' - Tipo 1...

exploit-cve-2018-7448

exploit-cve-2018-7448 Propósito Este es un script de Python para automatizar CMS Made Simple 2.1.6 - Ejecución remota de código - CVE-2018-7448. Fue creado basándose en https://www.exploit-db.com/exploits/44192. Uso python3 exploit-CVE-2018-7448.py -t 127.0.0.1/cmsms -d cms -u root -p password...

CVE-2026-95153

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...

CVE-2019-9053-exploit

CVE-2019-9053 — Unauthenticated SQL Injection in CMS Made Simple Descripción CVE-2019-9053 es una vulnerabilidad de inyección SQL time-based blind que afecta a CMS Made Simple en versiones ≤ 2.2.9. No requiere autenticación. El parámetro vulnerable es m1idlist en el módulo News moduleinterface.ph...

CVE-2022-42094

Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Card. Vectores de ataque: El atacante debe publicar algo en el "Card content" e insertar el payload...

CVE-2021-46366

CVE-2021-46366: Credential Bruteforce Attack via CSRF + Open Redirect in Magnolia CMS An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery CSRF in order to brute force and exfiltrate users'...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...

CVE-2021-46361

CVE-2021-46361: Omisión de Restricción de FreeMarker en Magnolia CMS Un problema en el Filtro FreeMarker de Magnolia CMS v6.2.11 y versiones anteriores permite a los atacantes eludir las restricciones de seguridad y ejecutar código arbitrario mediante una carga útil de FreeMarker manipulada...

EUVD-2026-93513

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

CVE-2026-105867 Payload: Client uploads could overwrite S3 objects

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

CVE-2025-25062

CVE-2025-25062 Description Usage Example Timeline Description A Stored Cross-Site-Scripting XSS vulnerability exists in the Backdrop CMS 1.29.2 post edit page. This script chains the vulnerability with a CSRF payload to achieve privilege escalation from the role of 'Editor' to 'Administrator'...

CVE-2018-16763

Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install git clone https://github.com/Trushal2004/CVE-2018-16763.git cd CVE-2018-16763/ python3 -...

CVE-2019-25137-Version-Research

CVE-2019-25137 Affected Version Research CVE-2019-25137 Overview CVE-2019-25137 is a XSLT injection vulnerability in Umbraco CMS. The vulnerability is present in the XSLT Extensive Stylesheet Language Transformations Visualizer webpage. The vulnerable URI for this webpage is...

Graver

Graver Description Proof of Concept script to exploit the authenticated SSTI+RCE in Grav CMS CVE-2024-28116. It creates a malicious RCE page on the server running the vulnerable Grav CMS. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28116 Notes Since it is an authenticated vulnerability ...

droopescan

droopescan Un escáner basado en plugins que ayuda a los investigadores de seguridad a identificar problemas en varios CMS. El uso de droopescan para atacar objetivos sin consentimiento mutuo previo es ilegal. Es responsabilidad del usuario final cumplir con todas las leyes locales, estatales y...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

XSS Reflejado en el Formulario de Inicio de Sesión Campos de Correo Electrónico y Contraseña Vvveb CMS v1.0.7.2 Autor: Andrew Paul Fecha de descubrimiento: 12 de agosto de 2025 Proveedor: Vvveb URL del proveedor: http://vvveb.com GitHub del proveedor: https://github.com/givanz/Vvveb Versión...

CVE-2022-27414

CVE-2022-27414 - SQL-Injection College Website CMS v1.0 - CVE-2022-27414 - SQL Injection CVE url https://vulners.com/cve/CVE-2022-27414 PoC below Vulnerable Code starts from line 9 in "cwms\departments\index.php" query"SELECT FROM departmentlist where deleteflag = 0 and status = 1 order by name...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Descripción Esta es mi PoC para el CVE-2023-30253 Dolibarr 17.0.0 inyección de código PHP. Cuando el plugin CMS Website núcleo está habilitado, un atacante autenticado puede obtener ejecución remota de comandos mediante una inyección de código PHP que evade las...