CVE-2026-85118 AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated privilege escalation. The root cause is a failure to enforce nonce or capability checks on specific AJAX actions , which allows unauthenticated users to update or delete arbitrary WordPr...

CVE-2026-107507 Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit

The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to...

EUVD-2026-96739

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

EUVD-2026-96736

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...

CVE-2026-103694

The Mobile builder WordPress plugin (versions through 1.4.2 ) is vulnerable to a privilege escalation flaw. The plugin fails to properly restrict which user meta keys a logged-in user can update via one of its REST routes . This allows any user with a self-registered account, such as a customer, ...

CVE-2026-103694 Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...

concealed_position

Posición Oculta Posición Oculta es un ataque de escalada de privilegios locales contra Windows que utiliza el concepto de "Trae tu propia vulnerabilidad". Específicamente, Posición Oculta CP utiliza la lógica tal como fue diseñada de paquete punto e impresión en Windows que permite a un usuario c...

climber

Climber Herramienta de auditoría automatizada para verificar configuraciones incorrectas en sistemas UNIX/Linux que pueden permitir la escalada local de privilegios. Dependencias python = 2.7 python-crypto python-mako python-paramiko Nota Climber necesita Exscript, un módulo de Python y un...

linux-soft-exploit-suggester

linux-soft-exploit-suggester Script para encontrar exploits para todo el software vulnerable en el sistema, centrándose en los paquetes de software en lugar de solo vulnerabilidades del kernel. Utiliza la base de datos de exploits para evaluar la seguridad de los paquetes y buscar exploits que...

elevationstation

Stazione di Elevazione Rubare e duplicare i token SYSTEM per divertimento e profitto! Duplichiamo le cose, creiamo copie gemelle, e poi ce ne andiamo in sella. Hai usato getsystem di Metasploit e PSEXEC di SysInternals per ottenere privilegi di sistema, vero? Bene, ecco una versione standalone...

uptux

uptux Chequeos especializados de escalada de privilegios para sistemas Linux. Implementados hasta ahora: Rutas de systemd, servicios, temporizadores y unidades de socket escribibles Desensambla archivos de unidad systemd buscando: Referencias a ejecutables que son escribibles Referencias a enlace...

shimit

shimit shimit es una herramienta Python que implementa el ataque Golden SAML. Más información sobre esto se puede encontrar en el siguiente artículo en nuestro blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...

Exchange2domain

Exchange2domain Herramientas todo en uno de privexchange. Solo necesitas abrir el puerto del servidor web, por lo que no se requieren privilegios elevados. ¡Gran artículo! Abusando de Exchange: una sola llamada a la API te separa de Domain Admin. Requisitos Estas herramientas requieren impacket...

kernel-exploits

Kernel Exploits Vari exploit del kernel CVE-2021-22555 Exploit Linux per root locale. Versione aggiornata dell'exploit di theflow per CVE-2021-22555. Una scrittura fuori dai limiti nella heap che riguarda Linux dalla v2.6.19-rc1 è stata scoperta in net/netfilter/xtables.c. Ciò consente a un...

CVE-2026-108708

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

EUVD-2026-96567

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant...

CVE-2026-85126: Improper Privilege Management

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

PT-2026-110143

Name of the Vulnerable Software and Affected Versions GoatCounter versions prior to 2.7.1 Description A mass assignment privilege escalation exists in the userPrefSave handler. This issue allows authenticated users to modify protected account fields using form-encoded requests. An attacker with...

CVE-2026-108740: Improperly Controlled Modification of Dynamically-Determined Object Attributes

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...