WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details

Description WordPress does not correctly handle some malformed relative URL paths while resolving them in some cases, which could allow users with Contributor-level access and above to trigger an uncontrolled loop and cause a denial of service through server worker exhaustion...

EUVD-2026-89336

simple-git: VISUAL editor environment variable is omitted from unsafe editor detection...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana：对 CVE-2026-21724 的修复不完整，允许编辑者角色删除受保护的联系点 产品： Grafana（Grafana Labs）—— 13.2.0 及之前版本 文件： pkg/services/ngalert/provisioning/contactpoints.go CWE： CWE-284 — 访问控制不当 CVSS 3.1： AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — 6.5（中危） CNA： Turan Security · CVE 记录 相关： CVE-2026-21724（本次被绕过的原始修...

CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105692

The open-source design and prototyping platform Penpot contains an IDOR vulnerability in its delete-share-link RPC before version 2.18.0 . The application fails to verify if a caller is the creator of a share-link or possesses administrator authority, checking only if the caller can edit the pare...

CVE-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105678

The Ghost Node.js content management system is vulnerable to an improper privilege management issue in versions 0.5.0 through 6.64.0 . Staff users holding the Editor or Super Editor roles can bypass permission restrictions to assign their own roles to users with Author or Contributor roles. This ...

CVE-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2019-12836

CVE-2019-12836 アプリケーション JEditor v3.0.5 - JIRA向けWYSIWIGエディタ Jira向けのシンプルかつ強力なリッチテキストエディタ。HTMLメールのインポート、リッチコンテンツの貼り付け、テンプレート作成、フィールドの事前入力が可能。 製品ベンダー Bobronix ベンダーウェブサイト http://bobronix.com/ CVE参照 https://vulners.com/cve/CVE-2019-12836 影響を受ける製品コードベース JEditor - Jira向けWYSIWYGエディタ - v3.0.5 影響を受けるコンポーネント...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 研究: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about パッチ分析:...

CVE-2018-17254

CVE-2018-17254 漏洞标题：Joomla JCK Editor 6.4.4 - 'parent' SQL注入 Google Dork：inurl:/plugins/editors/jckeditor/plugins/jtreelink/ 供应商主页：http://docs.arkextensions.com/downloads/jck-editor 版本：6.4.4 测试环境：Debian 10 Ubuntu Windows 11/10 CVE编号：CVE-2018-17254 PHP版本（漏洞利用）：7.3.27...

Joomla_CVE_2026_48907

MASTA CVE-2026-48907 スキャナー Joomla! JCE Editor 作成者: Alma !CAUTION 🚨 免責事項 — 使用前にお読みください これは侵入的なセキュリティテストツールです。 THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY. Scanning systems you do NOT own or have WRITTEN PERMISSION to test is ILLEGAL in most jurisdictions. The author Hussein Mohamed masta...

CVE-2022-42095

Backdrop CMS バージョン 1.23.0 脆弱性の説明: Backdrop CMS バージョン 1.23.0 には、Page コンテンツを介した格納型クロスサイトスクリプティング XSS 脆弱性が含まれていることが判明しました。 攻撃ベクター: 攻撃者は「Page content」に何かを投稿し、「Body」入力に XSS ペイロードを挿入し、Raw HTML エディタを選択して格納型 XSS を悪用する必要があります。XSS ペイロードは保存後すぐに実行されます。 影響を受けるバージョン: http://ipaddress//backdrop/node/add/page PO...

CVE-2023-42426

CVE ID: CVE-2023-42426 脆弱性タイプ: クロスサイトスクリプティング XSS 説明: Froala Froala Editor v.4.1.1 にはクロスサイトスクリプティング XSS の脆弱性があり、リモートの攻撃者が「Insert Image」コンポーネント内の「Insert link」パラメータを介して任意のコードを実行できる可能性があります。 再現手順: 1. 「Insert Image」オプションを選択し、新しい画像を追加します。 2. 追加した画像をクリックし、「Insert Link」オプションを使用して、次のペイロードを入力します:...

dbeaver v26.2.2

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

CVE-2026-105678: Improper Privilege Management

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 反射型跨站脚本（XSS） CVE ID： CVE-2021-3030 状态： 由 CVE 计划（MITRE）于 2021-01-06 保留。该 ID 从未发布过任何公开记录——本文档即为完成该发布所需的公开参考。 漏洞类型： 跨站脚本（XSS），反射型 — CWE-79 发现者： Athos Nogueira Gonzaga 厂商： CuteSoft（Cute Editor for ASP.NET）— https://cutesoft.net/ 受影响版本： Cute Editor...

CVE-2026-105220

A flaw was found in Twine. The application fails to properly sanitize markup during story import, allowing embedded malicious scripts to execute within the editor interface. By convincing a user to import a specially crafted story file, an attacker can leverage an internal inter-process...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform 発見・報告者: Astaruf 詳細記事: https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ NVDエントリ: https://nvd.nist.gov/vuln/detail/CVE-2020-13654 脆弱性 XWiki Platform のバージョン 12.8 より前では、プロファイルエディタにおいてユーザー制御のフィールドにHTMLエンコードが適用されません。調査で確認された影響を受けるフィールドは "Company" 編集 → 個人情報 内...