CVE-2026-14378

CVE-2026-14378 — PoC de contournement d'authentification DevKit Pro Scanner de preuve de concept et assistant d'exploitation pour CVE-2026-14378 : prise de contrôle de session administrateur non authentifiée dans le plugin WordPress DevKit Pro dplugins via un flux « revert » de changement...

CVE-2026-19660

CVE-2026-14378 — PoC de contournement d'authentification DevKit Pro Scanner de preuve de concept et assistant d'exploitation pour CVE-2026-14378 : prise de contrôle de session administrateur non authentifiée dans le plugin WordPress DevKit Pro dplugins via un flux « revert » de changement...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment كشف تقييم أمني لساعة Beat XP VEGA الذكية البرنامج الثابت RB303ATV006229 يركز على اتصال Bluetooth Low Energy BLE عن ضعف في التصميم والتنفيذ يمكّن جهازًا مركزيًا قريبًا بتقنية BLE من إنشاء جلسة BLE الوحيدة المتاحة والاحتفاظ بها دون مصادقة...

CVE-2021-32099

CVE-2021-32099 pandora fms 742 sqli pré-authentification POC http://localhost/pandoraconsole/include/chartgenerator.php?sessionid=a' UNION SELECT 'a',1,'idusuario|s:5:"admin";' as data FROM tsessionsphp WHERE '1'='1 Encodé en URL...

CVE-2026-23550

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗ ███████╗██║██╔██║ ██║ ╚█...

XSSFire

XSSFire Un script Blind XSS autonome. Comment ça marche : Le script est une combinaison de PHP et JavaScript. Il capture les données à l'aide de JS et les envoie au script lui-même, puis il génère des fichiers de rapport et les livre via Telegram. Prérequis : 1. Serveur web fonctionnant sous Linu...

CVE-2026-66917

IDOR + XSS stocké via une autorisation au niveau de l'objet cassée dans JoomGallery JoomGallery ≤ 4.3.0 — Un utilisateur au rôle Éditeur détourne n'importe quelle image de la galerie et stocke une charge utile XSS, permettant la prise de contrôle de la session administrateur RÉSUMÉ...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2025-34157

XSS مخزّن في تدفق الحذف في Coolify CVE-2025-34157 المتأثر: Coolify ≤ v4.0.0-beta.420.6 تم الإصلاح في: v4.0.0-beta.420.7 الخطورة: حرجة 9.4 متجه CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 التحقق غير السليم من الإدخال ملخص يسمح...

cve-2026-100671-poc

CVE-2026-100671 — Divulgation du cookie de session via Twig dans Grav Vérificateur minimal, local uniquement, pour la prise de contrôle de session via le cache de contenu Twig/page de Grav, corrigée dans Grav 2.0.25. Avis : CVE-2026-100671 GHSA-pp89-h475-7gj6 Version Grav 2.0.25 Périmètre...

CVE-2022-3949

CVE-2022-3949 XSS في Simple Cashiering System نظام Simple Cashiering System عرضة لثغرة البرمجة النصية عبر المواقع XSS - حيث يمكن لمهاجم خبيث تغيير الاسم الكامل fullname لمستخدم مخترَق إلى حمولة XSS Payload، وعندما يزور مستخدم admin تبويب المستخدمين user-tab أو تبويب المبيعات sales tab وينظر إلى...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-100671

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal...

EUVD-2026-90568

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-95687: Improper Privilege Management

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing a...

CVE-2026-87004

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

EUVD-2026-89474

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...

CVE-2026-71302

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...