CVE-2026-27540

🌐 语言 / Dil 📌 概述 WooCommerce Wholesale Lead Capture WWLC — 未认证文件上传 → RCE | ---|--- 产品| WooCommerce Wholesale Lead Capture — wwlc 插件 版本| ≤ 2.0.3.1 已修复| 2.0.3.2+ — 上传处理器已加固 认证| 未认证 向量| admin-ajax.php?action=wwlcfileuploadhandler 字段| file（multipart 上传） 写入路径| WordPress uploads 目录 Payload|...

Ultimate-Social-Scrapers

Ultimate Social Scrapers by Cyfy Labs 📢 重要なお知らせ 📢 Cyfy Labs は活動を終了しました。 これまでのご支援に心より感謝いたします！ 🫶 Cyfy Labs は、最新のソーシャルメディアスクレイピングツール を提供しています。当社の製品により、企業や研究者はリード生成、感情分析、市場調査などのユースケースに対して、数百もの公開データポイント を収集できます。 🌐 世界中で信頼されている当社のスクレイパーは、主要なプラットフォーム全体で 最も包括的なソーシャルメディアデータカバレッジ を提供し、実用的でデータに基づいた洞察...

phantomdrive

Ovrdrive サイズ : 36.6 x 15 mm 層数 : 4層 材質 : FR-4: TG150 厚さ : 0.6 mm 最小トラック/スペーシング : 4/4mil 最小穴径 : 0.2mm ソルダーマスク : 黒 シルクスクリーン : 白 エッジコネクタ : なし 表面仕上げ : HASL lead free ビア処理 : Tenting vias 仕上げ銅箔 : 1 oz Cu 内層銅:1 oz 製品番号削除 : はい...

WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture = 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-27542 info: name: WooCommerce Wholesale Le...

CVE-2026-48540

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540

Krayin CRM versions through 2.2.6 are vulnerable to a stored client-side template injection vulnerability. An authenticated attacker can inject Vue.js template expressions into the lead title field . By using double-brace template syntax, the attacker can reach the Vue template compiler to perfor...

EUVD-2026-86383

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540 Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

PT-2026-98261

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-76901: Authorization Bypass Through User-Controlled Key

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/id in PoolClueController.get and GET /pool/account/get/id in PoolCustomerController.get use bare pool-read permission checks without the CsPermission...

Exploit for CVE-2026-27540

🌐 Language / Dil --- 📌 Özet Woo...

CVE-2026-92459

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459

yshop-crm through 2.1.3 is affected by a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can invoke the lead-claim endpoint to reassign sales leads from other employees to themselves by overwriting the ownerUserId field. No a...

EUVD-2026-80664

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...