CVE-2026-81923

Concrete CMS versions before 9.5.3 are affected by a missing authorization check in the SEO Bulk Update Meta Tags editor . The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties(), allowing a user with access to the bulk SEO tool and view-only permission ...

WordPress Admin Menu Editor Pro 2.35-2.36 - Backdoor vulnerability

Backdoor vulnerability discovered by Unknown in WordPress Plugin Admin Menu Editor Pro versions 2.35-2.36...

CVE-2026-18111

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2017-11882

Resumen de CVE-2017-11882 Desde el punto de vista del efecto de explotación, puede vulnerar todas las versiones de Office, de 2003 a 2016, y la construcción de todo el entorno de ataque es muy sencilla. Esta vulnerabilidad es causada por el Editor de ecuaciones presente en el software de Office...

CVE-2026-34212

CVE-2026-34212 Docmost aceptó una URL javascript: dentro de un nodo de adjunto, la preservó durante el almacenamiento y renderizado, y la devolvió a un ancla enlaceable en el origen de Docmost. Introducción Identifiqué, divulgué responsablemente y reproduje un problema de XSS almacenado de graved...

CVE-2026-92059

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 es una vulnerabilidad crítica de control de acceso inadecuado en la extensión del editor JCE para Joomla. Permite a atacantes no autenticados crear nuevos perfiles de editor, lo que puede conducir a la subida arbitraria de archivos PHP y a la ejecución remota de códi...

CVE-2026-92059

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156...

CVE-2026-92059

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

CVE-2026-16593 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...

WordPress WP Directory Kit plugin <= 1.5.7 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...

CVE-2026-73321

CVE-2026-73321 XenForo anterior a 2.3.13 puede agotar un worker de PHP mediante BBCode profundamente anidado. Lo que validé La ruta pública editor/to-html envía BBCode proporcionado por invitados a través del parser y renderizador recursivo de XenForo. No aplica un límite de longitud bruta o de...

CVE-2026-48907

CVE-2026-48907 – Vulnerabilidad de Ejecución Remota de Código RCE no autenticada en Joomla JCE Gravedad: Crítica CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – Control de Acceso Inadecuado Software afectado: Extensión Joomla Content Editor JCE para Joomla Estado: Divulgada públicament...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: corrección incompleta para CVE-2026-21724 permite al rol Editor eliminar puntos de contacto protegidos Producto: Grafana Grafana Labs — hasta 13.2.0 Archivo: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Control de acceso inadecuado CVSS 3.1:...

CVE-2026-18117

Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...

CVE-2019-12836

CVE-2019-12836 Aplicación JEditor v3.0.5 - Editor WYSIWYG para JIRA Editor de texto enriquecido simple pero potente para Jira. Importa correos HTML, pega contenido enriquecido, crea plantillas y rellena campos predefinidos. Proveedor del Producto Bobronix Sitio web del proveedor...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Investigación: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Análisis d...