CVE-2025-25062

CVE-2025-25062 설명 사용법 예제 타임라인 설명 Backdrop CMS 1.29.2의 게시물 편집 페이지에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 이 스크립트는 CSRF 페이로드와 연계하여 '편집자' 역할에서 '관리자'로 권한 상승을 달성합니다. 관련 링크: https://vulners.com/cve/CVE-2025-25062 https://backdropcms.org/security/backdrop-sa-core-2025-001 사용법 usage: CVE-2025-25062.py -h -u...

Exploit-LPE-CVE-2026-21721

💥 CVE-2026-21721 익스플로잇 CVE-2026-21721 용 익스플로잇을 작성하고 테스트 스탠드에서 검증했습니다. 🎯 구성 내용 실전용 권한 상승 도구: 로그인 후 permissions를 읽고, 모든 대시보드에 Adminpermission=4 권한을 작성합니다. 익스플로잇에는 Editor 권한이 있는 유효한 계정이 필요합니다. 🧪 테스트 스탠드에서 검증됨 PoC가 확인된 fingerprint는 다음과 같습니다: "database": "ok", "version": "12.1.1" 본 자료는 정보 제공 및 교육 목적으로...

CVE-2026-18117

Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...

Alibaba Cloud Linux 3 : 0261: grafana (ALINUX3-SA-2026:0261)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0261 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33377: An Editor can overwrite a dashboard...

CVE-2026-27198 Formwork Improperly Manages Privileges During User Creation

Formwork is a flat file-based Content Management System CMS. In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has...

SUSE CVE-2022-31097

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate...

Stored XSS in Unified Alerting

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate...

CVE-2021-22966: Incorrect Authorization

Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group...