CVE-2026-71508

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71508 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

EUVD-2026-65081

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71503

Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71927

Multiple DrayTek VigorSwitch models are affected by a command injection vulnerability in the rebDevice function . The root cause is insufficient filtering of the username and password fields before they are passed to a system command execution context. A remote attacker with valid administrative ...

EUVD-2026-64983

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2023-30777

CVE-2023-30777 Generatore di URL Proof of Concept PoC per una vulnerabilità XSS riflessa nel plugin Advanced Custom Fields di WordPress. PoC generato da: Alucard0x1 Crediti dell'exploit: https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2024-54951

Monica-Gespeicherte-XSS-Schwachstelle CVE-2024-54951 CVE-2024-54951 Ich habe das Entwicklungsteam von Monica am 20.11.2024 per E-Mail kontaktiert. Ich habe sie auch über LinkedIn per Kontaktanfrage und in den folgenden Wochen über andere Plattformen kontaktiert. Veröffentlichung hier, da nach 3...

liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

XSS Archiviato Autenticato in LifeRay 7.2.1 GA2 tramite MyAccountPortlet eseguito dai Risultati di Ricerca In LifeRay versione 7.1.0 fino a 7.2.1 GA2 i campi Nome, Secondo Nome e Cognome per gli account utente sono tutti vulnerabili a un problema di XSS Archiviato. Qualsiasi utente può modificare...

EUVD-2026-64888

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Multiple XSS Memorizzate Autore: Sergio Descrizione: Rite CMS 3.0 è affetto da una vulnerabilità multipla di Cross-Site scripting XSS memorizzato che consente agli attaccanti di eseguire codice arbitrario tramite un payload creato nei campi della Home Page nel menu di Amministrazion...

Astra Linux – Vulnerability in curl

There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fixed null pointer dereferencing in pidfffindfields This function triggered a null pointer dereference if it was used to search for a report that wasn’t implemented on the device. This occurred both for optional and...

CVE-2025-13486

🔴 CVE-2025-13486 - Exploit del plugin WordPress Advanced Custom Fields Extended ACFE 📋 Panoramica Exploit proof-of-concept per CVE-2025-13486 , una vulnerabilità critica nel plugin WordPress Advanced Custom Fields: Extended ACFE che consente l'esecuzione remota di codice portando all'escalation d...

ExtendIntel

ExtendIntel Questo pacchetto estende il pacchetto Intel per registrare più campi Se il file intel contiene i seguenti campi, i dati verranno automaticamente aggiunti a intel.log. threatscore verdict verdictsource confidence desc lastseen firstseen url reports campaigns associated category...

CVE-2020-25270

CVE-2020-25270 PHPGurukul hostel-management-system 2.1 consente XSS tramite Nome del tutore, Relazione del tutore, Numero di contatto del tutore, Indirizzo, Città Fornitore - PHPGurukul Prodotto -https://phpgurukul.com/hostel-management-system V2.1 Tipo di vulnerabilità - Cross Site Scripting XSS...