rehex

Reverse Engineers' Hex Editor A cross-platform Windows, Linux, macOS, BSD hex editor for reverse engineering, and everything else. An online copy of the manual can be accessed here: solemnwarning.net/rehex/manual/. Features Large 1TB+ file support Decoding of integer/floating point value types...

CVE-2026-32639

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2026-32258

Winter CMS (a Laravel-based PHP CMS) versions 1.2.10 through 1.2.12 are vulnerable to stored XSS when authenticated backend users with the backend.manage_editor permission inject malicious code via Editor Settings → Markup Styles . The custom styles are compiled by the LESS parser and rendered un...

CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...

CVE-2019-12836

CVE-2019-12836 Applicazione JEditor v3.0.5 - Editor WYSIWYG per JIRA Un editor di testo ricco semplice ma potente per Jira. Importa email HTML, incolla contenuti ricchi, crea modelli e precompila i campi. Vendor del Prodotto Bobronix Sito Web del Vendor http://bobronix.com/ Riferimento CVE...

PT-2026-82318

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application...

generator-burp-extension

Burp Extension Generator Installation First, install Yeoman and generator-burp-extension using npm we assume you have pre-installed node.js. root@kitploit: npm install -g yo npm install -g generator-burp-extension Then generate your new project: root@kitploit: yo burp-extension Burp Extension...

EUVD-2026-42395

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript...

CVE-2026-18512

The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...

CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2022-42097

Backdrop CMS versione 1.23.0 Spiegazione della vulnerabilità: Backdrop CMS versione 1.23.0 è stato scoperto contenere una vulnerabilità di cross-site scripting XSS memorizzato tramite il campo Comment. Vettori d'attacco: L'attaccante deve pubblicare qualcosa nel campo "comment" e inserire il...

CVE-2022-42096

Backdrop CMS versione 1.23.0 Spiegazione della vulnerabilità: È stato scoperto che Backdrop CMS versione 1.23.0 contiene una vulnerabilità di cross-site scripting XSS memorizzato tramite il contenuto Post. Vettori d'attacco: L'attaccante deve pubblicare qualcosa sul "Post content" e inserire il...

CVE-2022-42095

Backdrop CMS Version 1.23.0 Erklärung der Schwachstelle: In Backdrop CMS Version 1.23.0 wurde eine gespeicherte Cross-Site-Scripting XSS-Schwachstelle über den Page-Inhalt entdeckt. Angriffsvektoren: Der Angreifer muss etwas im „Page content“ veröffentlichen und die XSS-Nutzlast in das Feld „Body...

CVE-2022-42094

Backdrop CMS Version 1.23.0 Erklärung der Sicherheitslücke: Backdrop CMS Version 1.23.0 wurde festgestellt, dass es eine gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke über den Card-Inhalt enthält. Angriffsvektoren: Der Angreifer muss etwas auf dem „Card content“ posten und die XSS-Nutzla...

CVE-2026-75982

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...