CVE-2025-14783-POC

🧨 CVE-2025-14783: Easy Digital Downloads 账户接管 PoC “信任是最可利用的安全缺陷。” 💀 描述 本仓库包含针对 CVE-2025-14783 的可运行概念验证（PoC），该漏洞是 WordPress 插件 Easy Digital Downloads EDD （版本 'passwordresetrequested', 'key' = $key, 'login' = rawurlencode $userlogin , , escurlraw $POST'eddredirect' // --- 注入点 , $message ; 通过控制...

PT-2026-102356

Name of the Vulnerable Software and Affected Versions ConvertPlus versions prior to 3.6.4 Description The plugin is susceptible to deserialization of untrusted data through the style parameter of the cp display preview modal AJAX action. The issue occurs because the nonce guard is bypassed when t...

CVE-2024-58386: Improper Limitation of a Pathname to a Restricted Directory

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2026-101109: Improper Neutralization of Input During Web Page Generation

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free 6.5.8 - The public vehicle-detail page task=view echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter...

PT-2026-102302

Name of the Vulnerable Software and Affected Versions Real Estate Manager Free versions prior to 6.7.9 Description Reflected Cross-Site Scripting occurs on the public property-detail page within the leave a review form. The title field repopulates directly from the request without escaping or...

CVE-2026-100753: Improper Neutralization of Input During Web Page Generation

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment...

PT-2026-102307

Name of the Vulnerable Software and Affected Versions Book Library Free versions prior to 6.4.6 Description Reflected Cross-Site Scripting occurs in the public book-detail page template located at site/views/view book/tmpl/default.php. The application echoes the raw title request parameter direct...

PT-2026-99962

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.9 Description Authenticated users with access to the GraphQL api module interface can execute arbitrary shell commands. The issue occurs because the PBX API module documentation generator uses an authenticated ho...

CVE-2025-32432

CVE-2025-32432 — Craft CMS = 5.6.16 Unauthenticated RCE Severity: Critical CVSS 10.0 Auth required: None Affected: Craft CMS 3.0.0-RC1 - 3.9.14, 4.0.0-RC1 - 4.14.14, 5.0.0-RC1 - 5.6.16 Patched in: Craft CMS 3.9.15 / 4.14.15 / 5.6.17, Yii2 2.0.50 Identify How to Confirm the Target is Vulnerable...

CVE-2026-97165

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

EUVD-2026-87931

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

EUVD-2026-87928

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97165

The Joomla Extension - svenbluege.de - Event Gallery extension versions prior to 6.5.0 is vulnerable to Reflected XSS and open redirect . The root cause is that the "return" parameter is base64-decoded and written directly to the "Back" link without sufficient validation. This could allow an atta...

CVE-2026-100859

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

EUVD-2026-87824

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...