CVE-2024-6536

説明 このスクリプトは CVE-2024-6536 の PoC です。Wordpress 用 Zephyr Project Manager プラグインで XSS が可能です。認証とプロジェクトマネージャ管理者権限が必要です。 使い方 root@kitploit: python3 CVE-2024-6536.py -u -p -w 例: python3 CVE-2024-6536.py -u user -p user -w http://localhost/wordpress リンク...

CVE-2026-26211

-orange?style=for-the-badge&logo=owasp CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting XSS CWE: CWE-79 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026 Summary A stored Cross-Site...

RISE-Ultimate_Project_Manager_e_CRM

CVE-2025-3855 - RISE Ultimate Project Manager - IDOR セキュリティ脆弱性: IDOR（安全でない直接オブジェクト参照） 影響を受けるコンポーネント: プロフィール画像アップロードエンドポイント、teammembers コントローラー ソフトウェア: RISE - Ultimate Project Manager & CRM ベンダー: codecanyon バージョン: 3.8.2 CVE ORG : https://vulners.com/cve/CVE-2025-3855 NIST:...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931

The Zephyr Project Manager WordPress plugin (all versions up to and including 3.3.205 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'message' parameter , caused by insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can in...

EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

PT-2026-87033

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931: Improper Neutralization of Input During Web Page Generation

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...

EUVD-2026-57317

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision...

WordPress WP Project Manager Pro plugin <= 4.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by dutafi in WordPress Plugin WP Project Manager Pro versions = 4.0.1...

GHSA-2Q2Q-JR9G-V9RF Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. Patches https://github.com/WeblateOrg/weblate/pull/19970 References Parts of this issue were independently report...

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. Patches https://github.com/WeblateOrg/weblate/pull/19970 References Parts of this issue were independently report...

WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability

Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...

CVE-2026-74930

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...

CVE-2026-74929

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2026-74928

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

EUVD-2026-66279

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...