CVE-2025-55287-POC

CVE-2025-55287-POC Genealogy 앱 4.4.0 이전 버전에서 인증된 저장형 크로스 사이트 스크립팅XSS 취약점으로, 임의의 JavaScript 실행 및 Editor+ 역할에서 Administrator로의 권한 상승이 가능합니다. 요약 취약점 유형: 저장형 크로스 사이트 스크립팅 CWE-79 영향을 받는 구성 요소: 'Person'의 이름과 성 영향을 받는 버전: 4.4.0 이전 모든 버전 영향: 피해자 브라우저에서 공격자가 제공한 JavaScript의 지속적 실행; 세션 하이재킹, DOM을 통한 CSRF, ...

osint-suite-tools

중요! 본 애플리케이션의 사용에 대한 책임은 저자에게 있지 않습니다. 이 애플리케이션은 GNU 라이선스를 따르는 오픈 소스 버전입니다. 그러나 유료 버전은 이 버전에서는 수행하지 않는 알고리즘 및 데이터 교차 분석을 통해 더 나은 결과를 제공합니다. 애플리케이션이 올바르게 작동하려면 제가 제공한 봇들로 빅데이터를 구축해야 합니다. 방법을 모르시나요? 회사에 필요하신가요? 저에게 연락하시면 방법을 알려드리겠습니다. 제 연락처는 아래에 있습니다. 버전| 라이선스| 링크 ---|---|--- Dante's Gates Telegram...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Sales Person+) Privilege Escalation vulnerability

Authenticated Sales Person+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Groundhogg versions = 4.9...

CVE-2025-67875

CVE-2025-67875: ChurchCRM, Person Property Assignment을 통한 저장형 XSS로 관리자 세션 하이재킹 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2025-67875 심각도| 높음 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 ChurchCRM/CRM 세부 내용 요약 ChurchCRM 버전 6.3.0 및 이전 버전에 심각한 권한 상승 취약점이 존재합니다. 특정 중간 수준 권한"Edit Records" 및 "Manage Properties and...

CVE-2026-100575

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

CVE-2026-100575

OpenClaw Slack versions before 2026.8.1 contain a vulnerability where multi-person direct messages fail to properly enforce sender allowlists . This flaw allows disallowed participants to bypass configured sender policies, enabling them to trigger Slack agents and gain unauthorized access to the ...

CVE-2026-48541

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541

Krayin CRM version 2.2.6 and prior is vulnerable to a stored client-side template injection leading to Cross-Site Scripting (XSS) . The root cause is the application's failure to sanitize the person name field , allowing authenticated attackers to inject Vue.js template expressions using double-b...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

EUVD-2026-86445

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-48541 Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

PT-2026-98262

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...

CVE-2026-48541: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

CVE-2026-86552

CVE-2026-86552 affects the ZTE SmartLife APP , where the app dynamically generates new authentication parameters at runtime. An attacker possessing valid SmartLife authentication credentials can complete account registration with any arbitrary email address via the backend endpoint /account/perso...

EUVD-2026-83648

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552 A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

CVE-2026-86552: Improper Privilege Management

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...

PT-2026-95905

Name of the Vulnerable Software and Affected Versions SmartLife app affected versions not specified Description The application dynamically generates authentication parameters at runtime. An attacker who acquires these credentials can use the backend interface '/account/person/signup.serv' to...

CVE-2026-78152

The SureRank SEO WordPress plugin, versions 1.6.2 through 1.10.0 , contains a vulnerability that allows unauthenticated visitors to obtain the registered account email addresses of users who have published content. This occurs because the plugin fails to exclude these email addresses from the str...