CVE-2025-66849

CVE-2025-66849 Ghost CMS Privilege Escalation PoC Summary In Ghost Foundation Ghost CMS up to 6.4.0, the HTML block within the post draft editor fails to properly sanitize or encode user-supplied content, resulting in a stored cross-site scripting XSS vulnerability. A user with Contributor...

CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2026-116020

BookStack versions prior to 26.09.2 are vulnerable to an incorrect authorization flaw in the AttachmentController . This vulnerability allows authenticated users to access attachments belonging to other users' unpublished draft pages by identifying sequential attachment IDs. Attackers with suffic...

EUVD-2026-109278

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...

RAGE

RAGE - Relational Attack Graph Exchange An attack graph you can actually hand to someone else. Every graph-based security product keeps your attack graph locked inside a proprietary store. You cannot export it, diff two scans, put it in version control, or query it with anything but the vendor's...

crml

CRML — Cyber Risk Modeling Language Status: Draft. This project is under heavy development and may change without notice. We welcome input, issues, and contributions. ⚠️ WARNING This codebase is currently being developed on the crml-dev-1.3 branch. For the latest work-in-progress and source of...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

intra-handshake-fail

Intra-handshake fail This is the working area for the individual Internet-Draft, "Intra-handshake fail". Editor's Copy Datatracker Page Individual Draft Compare Editor's Copy to Individual Draft Contributing See the guidelines for contributions. The contributing file also has tips on how to make...

bug-bounty-standards

What is This Repository? This repository is a list of situations that occur in bug bounty programs and how they should be handled. Many of these are currently handled on a case-by-case basis, which leads to a lot of uncertainty and frustration from hackers, program owners and platforms. The goal ...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

EUVD-2026-105107

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content...

EUVD-2026-104642

Pillow: Heap buffer overflow in ImagingJpegDecode...

npm: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

npm: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

CVE-2026-113660 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

CVE-2026-113660 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...

CVE-2026-113660

Prior to version 4.33.0 , the ApostropheCMS open-source Node.js content management system is vulnerable to an authenticated object-level authorization bypass in its exist-in-locale API. This flaw allows an authenticated low-privilege user to verify the existence of restricted documents across var...

DEBIAN-CVE-2026-113356

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

CVE-2026-113356

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

EUVD-2026-104927

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...