CVE-2026-89080

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

CVE-2025-34157

Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...

CVE-2022-3949

CVE-2022-3949 XSS in Simple Cashiering System Simple Cashiering System is vulnerable to Cross Site Scripting XSS - a malicious actor can change the fullname of a compromised user to a XSS Payload and whenever a admin visits the user-tab or the sales tab and looks into sales made by the malicious...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81911

Concrete CMS versions 9.0.0 through 9.5.2 contain a Stored XSS in the Board Custom Slot dialog. The custom_slot save_template endpoint authorizes requests only against the target board instance via canEditBoardContents() but persists the client-supplied selectedTemplateOption[collection] verbatim...

EUVD-2026-76447

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2025-69821-Beat-XP-Vega-Smartwatch-Security-Assessment

CVE-2025-69821 : Beat-XP-Vega-Smartwatch-Security-Assessment Una evaluación de seguridad del Beat XP VEGA Smartwatch Firmware RB303ATV006229 centrada en la conectividad Bluetooth Low Energy BLE reveló una debilidad de diseño e implementación que permite que un dispositivo central BLE cercano...

CVE-2021-32099

CVE-2021-32099 pandora fms 742 sqli pre authentication POC root@kitploit: http://localhost/pandoraconsole/include/chartgenerator.php?sessionid=a' UNION SELECT 'a',1,'idusuario|s:5:"admin";' as data FROM tsessionsphp WHERE '1'='1 URL Encoded root@kitploit:...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

PT-2026-89162

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

Adobe ColdFusion 2023.x < 2023 Update 24 / 2025.x < 2025 Update 13 Multiple Vulnerabilities (APSB26-119)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 24 or 2025.x update 13. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-119 advisory. - Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval...

PT-2026-89167

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

Adobe Commerce - Authentication Bypass

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high...

BIT-GRAFANA-2026-14199 Session takeover via Auth Proxy cache key collision

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

BIT-GRAFANA-2026-12704 SAML assertion replay via skipped InResponseTo validation

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...

CVE-2026-23550

root@kitploit: ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ███████╗ ███████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗╚════██╗██╔════╝ ██╔════╝██╔═████╗ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╔╝ █████╔╝███████╗...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Bypass de autenticación simple poc de bypass de autenticación; si quieres acceder a través del navegador, no olvides cambiar la variable USERAGENT en el script según lo que se muestre en tu navegador para que funcione. usa un editor de cookies para reemplazar el valor sid y u...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...