CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 一个隐藏字段。一个被篡改的值。获得整个网站的完全访问权限。 🧨 攻击者能做什么？ 能力| 影响 ---|--- 🔑 无需登录创建管理员账户| 整站接管 📦 访问 WooCommerce 客户数据| 数据泄露 💉 编辑插件/主题文件（PHP）| 远程代码执行 🕳️ 创建隐藏后门| 持久化访问 👥 查看所有用户数据| 侵犯隐私 🔬 漏洞分析 漏洞位置 root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser 漏洞代码...

CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Technical Overview This repository contains a Functional Proof of Concept PoC for a Mass Assignment vulnerability in Camaleon CMS versions prior to 2.8.1. The vulnerability resides in the updatedajax endpoint of the User Management module,...

CVE-2025-2563

CVE-2025-2563 WordPress 插件 User Registration & Membership 在 4.1.2 之前的版本中，当 Membership Addon 启用时，未能阻止用户设置其账户角色，从而导致权限提升问题，并允许未经身份验证的用户获取管理员权限。 🔴 漏洞概述 CVE-2025-2563 — 通过 Membership Addon 角色注入实现未认证权限提升 描述： WordPress 的 User Registration & Membership 插件在 4.1.2 之前的版本中，当 Membership Addon...

CVE-2025-2304_POC

CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS Privilege Escalation This POC is used to exploit Camaleon CMS privileges to administrator. The exploit works by injecting role into the password reset function of an authenticated user. Prerequisites & Assumptions You have a user account on the...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Doctreat Core versions = 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers t...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 🔴 Vulnerability Overview CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration Description: The User Registration & Membership plugin for WordPress is...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - 缺失授权导致已认证（学生+）权限提升至管理员 🔴 漏洞概述 CVE-2026-4484 — 已认证权限提升（学生 → 管理员） 描述： WordPress 的 Masteriyo LMS 插件在直至并包含 2.1.6 的所有版本中存在权限提升 漏洞。该漏洞源于 InstructorsController::prepareobjectfordatabase 函数，该函数在 REST API 请求期间未能正确限制角色分配。拥有低至学生级别 访问权限的已认证攻击者可以构造特制的 POST 请求发送至 Masteriyo...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - 未认证权限提升 作者： Hyun Chiya 漏洞信息 字段| 值 ---|--- CVE ID| CVE-2025-14736 插件| Frontend Admin by DynamiApps 受影响版本| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST payload with 'role'='administrator'" C -- D"POST to /wp-admin/admin-ajax.php" D ...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...

CVE-2026-1492

CVE-2026-1492 - WordPress 用户注册插件权限提升漏洞利用 描述 本仓库包含针对 CVE-2026-1492 的概念验证漏洞利用代码，该漏洞影响 WordPress 用户注册与会员 插件。 该漏洞允许 未认证的攻击者 通过滥用会员注册流程创建管理员账户。 👉 该漏洞的完整技术分析可在此处查看： 技术分析 其中逐步解释了后端如何处理攻击者控制的数据，以及为何能够实现权限提升。 漏洞详情 CVE ID ：CVE-2026-1492 组件 ：用户注册与会员插件（WPEverest） 受影响版本 ：= 5.1.2 漏洞类型 ：权限管理不当（CWE-269） 是否需要认证 ：...

CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Exploit for CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Pr...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

DEBIAN-CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

SSSD (System Security Services Daemon) LDAP sudo provider is vulnerable when ldap_sudo_search_base is not configured; SSSD will search the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object, granting root-level ...

CVE-2026-14474 Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...