CVE-2022-1329

WP Elementor 3.6.0/1/2 Ejecución Remota de Código Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version Version:...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down...

CVE-2026-100620

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100620

The Capgo CLI (npm package @capgo/cli ) through version 7.98.2 is affected by an over-permissioned service account during the Android onboarding flow. When users onboard via Google OAuth , the CLI incorrectly requests the account-wide CAN_MANAGE_DRAFT_APPS_GLOBAL permission via the Android Publis...

CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Ejecución remota de código Fecha: 16 de abril de 2023 Autor del exploit: Việt Hùng https://github.com/phanthibichtram12 Sitio web del proveedor: https://elementor.com/ Enlace del software: https://wordpress.org/plugins/elementor/advanced/ desplácese...

Linux Distros Unpatched Vulnerability : CVE-2026-61628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticat...

CVE-2026-61628

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 — lucasdillmann nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates...

Exploit for CVE-2026-61628

abraxaslabs.tech · github.com/abraxas ·&...

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-PXCX-FV34-X9P5 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-61628

nginx ignition , a user interface for the nginx web server, contains an unauthenticated admin account creation vulnerability in versions prior to 2.41.1 . The endpoint POST /api/users/onboarding/finish is registered as anonymous and uses a TOCTOU race condition between the onboarding-completion c...

EUVD-2026-83947

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-61628: Concurrent Execution using Shared Resource with Improper Synchronization

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-20071

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...

CVE-2026-20071 ISE 802.1x Session Hijack Vulnerability

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...

CVE-2026-20071 ISE 802.1x Session Hijack Vulnerability

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...