nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Author: Subhodeep Baroi CVE-2024-40119: CSRF Vulnerability in Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 Description CVE-2024-40119 is a Cross-Site Request Forgery CSRF vulnerability in the Nepstech Wifi Router xpon NTPL-XPON1GFEVN v1.0 firmware v2.0.1. This...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Aviso de seguridad: Cross-Site Scripting almacenado no autenticado que conduce a la toma de control de la cuenta de administrador openclaw-dashboard Título: OpenClaw Dashboard v3.0.0 XSS almacenado a través del campo de nombre de usuario en inicio de sesión fallido ID de CVE asignado:...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 是一个 CVSS 8.8（高危）的认证（Agent+）权限提升漏洞，存在于 LatePoint – 日历预订插件中 CVE-2026-6741 — LatePoint 权限提升扫描器 插件： LatePoint – 用于预约和活动的日历预订插件 latepoint CVE ID： CVE-2026-6741 CVSS 评分： 8.8（高危） CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 漏洞类型： 已认证（Agent+）权限提升 → 管理员接管 受影响版本： id =...

CVE-2025-14340

XSS para la toma de control de la cuenta de administrador CVE-2025-14340 Una vulnerabilidad de Cross-Site Scripting en la interfaz REST de administración de Payara permite la ejecución de JavaScript controlado por el atacante, lo que provoca la toma de control de la cuenta de administrador. Esto ...

CVE-2023-32707

CVE-2023-32707 An improved POC exploit based on the reported CVE on exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Overview This script allows for exploiting a vulnerability in Splunk 9.0.5, leading to admin account takeover. The exploit leverages a low-privile...

CVE-2025-50363_BXSS_CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Privilege Escalation via Blind XSS Affected Versions:v1.0 💣Vulnerability Description: A Blind Cross-Site Scripting XSS vulnerability was discovered in the Maid Hiring Management System, which allows a...

CVE-2021-40101

Survey XSS combined with CSRF leads to Admin Account Takeover in Concrete5 8.5.4 A Concrete CMS admin in versions below 9 did not have to provide their password when changing another user's password. In combination with CVE-2021-28145 "Concrete CMS formerly concrete5 before 8.5.5 allows remote...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Plugin de WordPress Modular DS Acceso de Administrador No Autenticado Prueba de Concepto PoC que demuestra CVE-2026-23550 - toma de control crítica de cuenta de administrador sin autenticación en el plugin de WordPress Modular DS versiones ≤2.5.1. Explotado...

CVE-2026-56736

The open-source FAQ web application phpMyFAQ is vulnerable to a stored cross-site scripting (XSS) flaw in versions prior to 4.2.0-alpha . The root cause is an HTML entity bypass where the html_entity_decode() function converts entities into executable HTML after strip_tags() has already processed...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Omisión de autenticación para apropiación de cuenta de administrador Descripción : Burst Statistics 3.4.0 - 3.4.1.1 - Omisión de autenticación para apropiación de cuenta de administrador El plugin Burst Statistics – Privacy-Friendly WordPress Analytics Google...

CVE-2026-56736: Improper Neutralization of Input During Web Page Generation

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

WordPress TranslatePress plugin has a vulnerability related to information leakage

The WordPress TranslatePress plugin is a multilingual translation plugin for WordPress. The TranslatePress plugin has a vulnerability related to information leakage. This vulnerability stems from the sensitive information exposure that occurs during the trpgettranslationsregular AJAX operation...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...