CVE-2026-18117

Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...

CVE-2025-25062

CVE-2025-25062 説明 使用方法 例 タイムライン 説明 保存型クロスサイトスクリプティング（XSS）の脆弱性が、Backdrop CMS 1.29.2 の投稿編集ページに存在します。このスクリプトは、この脆弱性をCSRFペイロードと連鎖させ、「Editor」ロールから「Administrator」への権限昇格を実現します。 関連リンク： https://vulners.com/cve/CVE-2025-25062 https://backdropcms.org/security/backdrop-sa-core-2025-001 使用方法 root@kitploit:...

Exploit-LPE-CVE-2026-21721

💥 CVE-2026-21721 Exploit Написал exploit для CVE-2026-21721 и проверил на стенде. 🎯 Что внутри Боевой эскалатор: логинится, читает permissions, пишет Admin permission=4 на всех дашбордах. Для эксплуатации нужна валидная учетная запись с правами Editor. 🧪 Проверено на стенде Вот fingerprint, на...

CVE-2026-27198 Formwork Improperly Manages Privileges During User Creation

Formwork is a flat file-based Content Management System CMS. In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has...

SUSE CVE-2022-31097

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate...

Stored XSS in Unified Alerting

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate...