CVE-2026-105684: Exposure of Sensitive Information to an Unauthorized Actor

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2023-5024

Exploit Title: PLANNO 23.04.04 COMMENT CROSS SITE SCRIPTING Exploit Author: Angel Metz AKA PH03N1XSP Vendor Homepage: Planno Software Link: GitHub - PlanningBiblio Version: alert1; 4. 스크립트를 입력한 후, 반사형 XSS를 확인합니다. 두 번째 경로 1. 자격 증명을 사용하여 로그인합니다. 2. 오른쪽 상단으로 이동하여 "Enregistrer comme modele"을 클릭합니다. 3...

CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc 랩 설정 Docker 컨테이너를 시작한 후 몇 가지 설정이 필요합니다. 127.0.0.1:8080에 접속하여 구성을 완료한 다음 관리자 페이지 - 외관 - 테마에서 테마를 선택하고, 사용자 정의 및 설정을 진행합니다. 디자인 - 템플릿 - 단일 글single post로 이동합니다. 오른쪽에서 아바타를 선택하고, 테마 편집기로 이동합니다. 먼저 아바타를 클릭한 다음 오른쪽 상단에서 설정을 클릭합니다. 오른쪽에 두 가지 속성사용자 프로필에 연결 및 새 창...

ExportDumper

ExportDumper PEファイルのエクスポートテーブルをダンプするために作成した小さなツールです。主な用途はDLLプロキシ内での使用を想定しています。 使い方 .\ExportDump dllpath 例 .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done. Check pragma.h...

CVE-2023-45966

CVE-2023-45966 umputun/remark42 에 악성 JSON이 포함되면, title 필드가 누락되고 url 필드의 필터링이 충분하지 않아 댓글 생성 요청에서 Blind SSRF가 발생합니다. 추가 정보 커밋 efceed6에서 수정됨 취약점 유형 기타 CWE-918: Server Side Request Forgery 제품 공급업체 https://github.com/umputun 영향받는 제품 코드 베이스 영향받는 버전: umputun/remark42 = 1.12.1 영향받는 구성 요소 /api/v1/comment ...

CVE-2019-9787

CVE-2019-9787 CSRF PoC 개요 CVE-2019-9787 CSRF의 PoC WordPress 버전 5.1.1 CVE-2019-9787 테스트 목적 외에는 사용하지 마십시오. 설치 docker-compose up -d 공격 1. http://localhost:8080/wp-admin/install.php에 접속하여 WordPress를 설치하세요. WP 관리자 계정만 생성하면 됩니다. 2. 방문자로 http://localhost:8080/?p=1comments에 접속한 뒤 "Hacker Attack...

EUVD-2026-92044

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124: Improper Neutralization of Input During Web Page Generation

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124

The W (vincent-peugnet/wcms) content management system, versions through 3.18.0 , is vulnerable to unauthenticated stored XSS . The root cause is the lack of input sanitization in the login user field and the visitor comment website field . Attackers can inject scripts via failed login attempts, ...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 w3 total cache cve 2013-2010에서 원격 코드 실행 사용법: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" 출력: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import requests import argparse def...

CVE-2009-4623

CVE-2009-4623 CVE-2009-4623 원격 쉘: 비대화형 쉘을 얻고, 고급 사용을 위해 다른 쉘을 여십시오!!! 사용법: CVE-2009-4623.sh hostnameandPath 예시: CVE-2009-4623.sh http://192.168.1.24/advancedcommentsystem/admin.php 옵션: -h 이 잡동사니...

CVE-2021-39473

CVE-2021-39473 영향을 받는 제품 코드 베이스 HotelManager - v1.2 영향을 받는 구성 요소 Kernel.php; Middleware 공격 유형 원격 공격 벡터 이 취약점을 악용하려면 사용자가 "rooms" 또는 "guests" 또는 "reservations" 또는 "users"를 생성하고 "comment" 또는 "contact" 필드에서 우회 없이 XSS 페이로드를 실행할 수 있습니다. 저장된 XSS입니다. 엔드포인트rooms, guests, ...에 페이로드를 저장하고 다른 계정으로 트리거할 수 있었...

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

EUVD-2026-91914

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...