47003 matches found
CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2022-42094
Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Card. Vectores de ataque: El atacante debe publicar algo en el "Card content" e insertar el payload...
CVE-2022-42097
Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del Comment . Vectores de ataque: El atacante debe publicar algo en el "comentario" e insertar el payload XSS en l...
CVE-2025-50286
Grav CMS v1.7.48 / Admin Plugin v1.10.48 - RCE autenticado a través de la subida de plugins CVE-2025-50286 Grav CMS v1.7.48 con Admin Plugin v1.10.48 es vulnerable a Ejecución Remota de Código RCE a través de la función de subida de plugins "Instalación Directa", permitiendo a administradores...
CVE-2023-41425
CVE-2023-41425 Description Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. Working The attached exploit "exploit.py" performs the following actions: 1. It takes 3...
Mezzanine-CMS-6.1.0-XSS
Mezzanine-CMS-6.1.0-XSS CVE-2025-50481 Descripción Una vulnerabilidad de cross-site scripting XSS en el componente /blog/blogpost/add de Mezzanine CMS v6.1.0 permite a los atacantes ejecutar scripts web arbitrarios o HTML mediante la inyección de un payload manipulado en una entrada de blog. CVE:...
CVE-2021-38699-Reflected-XSS
CVE-2021-38699 : Múltiples XSS Reflejados en TastyIgniter v3.0.7 Restaurtant CMS Existe XSS reflejado autenticado en el panel de administración de TastyIgniter en la versión 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Parámetro start del panel de administración: root@kitploit: POST...
CVE-2018-16763
CVE-2018-16763 Exploit Title: fuel CMS 1.4.1 - Remote Code Execution Python3 script - 💻 This script was developed by h3x0v3rl0rd...
CVE-2026-73858
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
CVE-2018-16763
Exploit CVE 2018-16763 Introducción PreAuth-RCE en FUEL CMS 1.4.1 Demo Referencias: https://nvd.nist.gov/vuln/detail/CVE-2018-16763 https://www.exploit-db.com/exploits/47138...
ICG-AutoExploiterBoT
ICG-AutoExploiterBoT ❗ Edit Line 44 Add your Email Address for Add admin joomla Exploit Use outlook.com Mail! ✔️ :warning:Note! : We don't Accept any responsibility for any illegal usage. AutoExploiter Not working for now! please Wait for update This software! AutoExploiter Not working for now!...
CVE-2025-63314
CVE-2025-63314 - Manejo inadecuado del token de restablecimiento de contraseña en Acora CMS Descubierto por Joby Y Daniel de Crowe India 📌 Resumen DDSN Interactive cm3 Acora CMS versión 10.7.1 contiene una vulnerabilidad de seguridad en su funcionalidad de restablecimiento de contraseña. La...
CVE-2024-48652
CVE-2024-48652 Vulnerabilidad de Cross Site Scripting en camaleon-cms v.2.7.5 permite a un atacante remoto ejecutar código arbitrario a través del campo de nombre del grupo de contenido Pasos para reproducir: 1. Abra la URL: http://127.0.0.1/admin/dashboard 2. Inicie sesión con credenciales de...
Solspace Freeform: Limited Twig template injection via submitted field values
Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...
CVE-2026-73858
The Solspace Freeform plugin for Craft CMS (versions 5.0.0 through 5.10.13) is vulnerable to a limited server-side Twig template injection (SSTI). An unauthenticated attacker can submit Twig expressions through public Freeform forms; these expressions are evaluated by the isolated Twig renderer w...
CVE-2020-13405
CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...
CVE-2024-37843-POC
CVE-2024-37843-POC PoC para CVE-2024-37843. Inyección SQL ciega basada en tiempo en Craft CMS Detalles disponibles en blog PoC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \ \n \n LIMIT 5 AS...