CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Escalada de Privilegios sin Autenticación Autor: Hyun Chiya Información de la Vulnerabilidad Campo| Valor ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Versiones Afectadas| B"Extract Nonce acfnonce & Form ID acfform" B --...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Escalada de Privilegios No Autenticada mediante Inyección de Rol 🔥 Resumen de la Vulnerabilidad El plugin de WordPress Divi Form Builder en versiones = 5.1.2 es vulnerable a una escalada de privilegios no autenticada. Esta falla crítica permite a...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 未认证权限提升（通过角色注入） === Beelze 零日漏洞 1diot9 === 📋 漏洞信息 字段| 详情 ---|--- CVE ID| CVE-2026-5118 CVSS 评分| 9.8 严重 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 — 不恰当的权限管理 插件| Divi Form Builder 由 Divi Engine 开发 受影响版本| 所有版本 ≤ 5.1.2 已修复版本| 5.1.3...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder Un campo oculto. Un valor modificado. Acceso completo a todo el sitio web. 🧨 ¿Qué puede hacer el atacante? 🔬 Análisis de Vulnerabilidad Ubicación de la Vulnerabilidad root@kitploit: includes/shared/handlers/FormSubmissionHandler.php → createuser Código Vulnerable...

CVE-2025-2304-CamaleonCMS-PoC

PoC：CVE-2025-2304 - Camaleon CMS 权限提升 技术概述 本仓库包含一个针对 Camaleon CMS （2.8.1 之前版本）中 Mass Assignment 漏洞的功能性概念验证 PoC。该漏洞位于用户管理模块的 updatedajax 端点，应用程序未能严格过滤 password 参数哈希中的敏感属性。 通过在配置文件更新期间向 password 作用域注入 role 属性，低权限用户可以覆盖自身的权限以获得 admin 状态。 漏洞机制 该漏洞源于 Ruby on Rails 控制器中 Strong Parameters 的配置错误。当应用程序处理...

CVE-2025-2563

CVE-2025-2563 El plugin User Registration & Membership de WordPress, anterior a la versión 4.1.2, no impide que los usuarios establezcan su rol de cuenta cuando el Membership Addon está habilitado, lo que provoca un problema de escalada de privilegios y permite que usuarios no autenticados obteng...

CVE-2025-2304_POC

CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS 权限提升 此POC用于利用Camaleon CMS的权限提升至管理员。该漏洞通过向已验证用户的密码重置功能注入角色来实现。 前提条件与假设 你在目标Camaleon CMS上拥有一个用户账户 ，且该账户可以访问 /admin。 1. 拦截 首先登录你的用户账户。登录后，访问个人资料页面并点击更改密码。 使用Burp Suite拦截密码更改功能。 2. 修改Payload 以下面的示例为基础，编辑你的payload，添加角色。 root@kitploit:...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Escalada de Privilegios No Autenticada mediante Inyección de Rol 🔥 Resumen de la Vulnerabilidad El plugin de WordPress Doctreat Core versiones = 1.6.8 es vulnerable a una vulnerabilidad de escalada de privilegios no autenticada. Esta falla crítica permite a...

CVE-2026-1492

CVE-2026-1492 - WordPress User Registration Plugin Privilege Escalation Exploit Description This repository contains a proof-of-concept exploit for CVE-2026-1492 , a critical vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Escalada de Privilegios no Autenticada mediante Registro de Membresía 🔴 Resumen de la Vulnerabilidad CVE-2026-1492 — Escalada de Privilegios no Autenticada mediante Registro de Membresía Descripción: El plugin User Registration & Membership...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - Autorización faltante que permite la escalada de privilegios de usuario autenticado Estudiante+ a Administrador 🔴 Resumen de la vulnerabilidad CVE-2026-4484 — Escalada de privilegios autenticada Estudiante → Administrador Descripción: El complemento Masteriyo...

CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Exploit for CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Pr...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

DEBIAN-CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

SSSD (System Security Services Daemon) LDAP sudo provider is vulnerable when ldap_sudo_search_base is not configured; SSSD will search the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object, granting root-level ...

CVE-2026-14474 Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...