CVE-2026-81818

Flowintel (versions ≥3.3.0) contains an authorization flaw in the administrative user-edit API . The existing check prevented an organization administrator from editing users in another organization but did not block editing a full administrator within the same organization. This allowed an org a...

CVE-2026-81818 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...

CVE-2023-22515-joaoviictorti

CVE-2023-22515 Panoramica Compilazione Utilizzo Esecuzione di CVE-2023-22515 Panoramica Confluence è un wiki aziendale basato sul web sviluppato dalla società australiana di software Atlassian. Atlassian è stata informata di un problema segnalato da alcuni clienti in cui attaccanti esterni...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress Plugin Unauthentifizierter Admin-Zugriff Proof-of-Concept PoC , das CVE-2026-23550 demonstriert – kritische Übernahme von Admin-Konten ohne Authentifizierung im Modular DS WordPress-Plugin Versionen ≤2.5.1. Wird aktiv in freier Wildbahn...

CVE-2026-27944

CVE-2026-27944 POC: Download de Backup Não Autenticado do Nginx UI + Acesso ao Painel Este repositório contém um Proof of Concept POC aprimorado para CVE-2026-27944 , uma vulnerabilidade crítica no Nginx UI. A vulnerabilidade permite que um atacante não autenticado baixe backups do sistema atravé...

CVE-2026-0920-WordPress-LA-Studio-Exploit

CVE-2026-0920 PoC: LA-Studio Element Kit Backdoor-Exploit Ein robuster Proof-of-Concept-Exploit PoC, geschrieben in Go, für die kritische Backdoor-Schwachstelle im LA-Studio Element Kit für Elementor -Plugin Versionen = 1.5.6.3. Dieses Tool demonstriert, wie ein nicht authentifizierter Angreifer...

CVE-2023-6329

CVE-2023-6329 — Umgehung der Authentifizierung bei Control iD iDSecure Ein Python Proof-of-Concept-Exploit für CVE-2023-6329 , eine Schwachstelle durch unzureichende Zugriffskontrolle in Control iD iDSecure Versionen 4.7.43.0 und niedriger. Der Fehler ermöglicht es einem nicht authentifizierten...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

EUVD-2026-65075

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-13598

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2026-62666

Grav API Plugin (a RESTful API for Grav CMS) prior to 1.0.6 contains a privilege escalation flaw. The UsersController methods createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check that sibling user mutation endpoints enforce. A non-super account holding api.use...