Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

plausible-editor-invite

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · plausible-editor-invite plausible-editor-invite Plausible Analytics community edition, GitHub master d44e104ae3943a9240d5cb6b62e67dff0f069d3a 2026-10-16 - Plausible Insights OÜ Class: Privilege leftover invitation-tok...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2026-76012

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2026-76012 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2026-76012

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 4.4.1 . The flaw resides in the legacy_render function, triggered by broken authorization on the gallery_edit endpoint. Attackers can...

CVE-2026-76012 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

HTB-Facts-Writeup

HackTheBox — Facts Machine Writeup Machine Info Field| Details ---|--- Name| Facts OS| Linux Difficulty| Easy Release| Season 10 Retired| No Attack Chain Overview Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Project Description CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS versions 2.9.1 that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password...

CVE-2025-2304

Camaleon CMS v2.9.1 - Mass Assignment leads to Privilege Escalation Exploit Tool - PoC Description This project is a Python-based exploitation proof of concept tool that demonstrates and analyzes a privilege escalation vulnerability affecting v2.9.1 of Camaleon CMS. The script automates the proce...

CVE-2026-119565

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

Mass-Assigner

Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2026-119565

Plausible Analytics versions through 3.2.1 are susceptible to a mass assignment vulnerability in the update_traffic_change_notification function. This flaw allows authenticated site editors to reassign notifications by including a site_id parameter in a PUT request to /sites/:domain/traffic-chang...

CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

EUVD-2026-113830

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotificationsiteid set to another site's primary key vi...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Privilege Escalation Exploit Overview This Python script exploits a critical mass assignment vulnerability in Camaleon CMS version 2.9.0, allowing any registered user to escalate their privileges to administrator. Vulnerability Details CVE : CVE-2025-2304 - Ma...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Inspired from https://github.com/dreadlocked/Drupalgeddon2 Supports: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, attacking account/mail & postrender parameter, using PHP's passthru function Pending Yet ...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

CVE-2025-2304

Camaleon CMS -p Arguments -t, --target Base target URL -u, --username Valid low-privileged username -p, --password User password Exploit Flow 1. Retrieve login page and extract CSRF token 2. Authenticate with provided credentials 3. Access profile edit page 4. Extract password update endpoint and...