Duplicate-of-CVE-2023-26982

Trudesk 版本 1.2.6 漏洞说明： Trudesk 1.2.6 版本被发现存在一个存储型跨站脚本（XSS）漏洞，通过工单 创建/修改工单标签 功能，涉及管理员角色。 攻击向量： 攻击者需要进入设置菜单，选择工单，然后向下滚动找到工单标签。点击 创建，在 添加标签 输入框中插入 XSS 有效载荷，创建标签 即可利用存储型 XSS。保存后 XSS 有效载荷会立即执行。 受影响： http://IP:8118/settings/tickets POST /api/v1/tags/create Parameter : tag 有效载荷： 测试环境： 1. Trudesk 1.2.6 版...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 攻击者向 wpajaxnoprivwcfmajaxcontroller AJAX 动作发送特制请求，以修改会员注册表单并将注册角色设置为管理员。然后，插件处理该请求并修改会员注册表单，允许用户以管理员角色进行注册。 攻击者可以通过提交修改后的会员注册表单，以管理员角色注册为新用户。...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 权限提升 ║ ║ 通过注册表单进行未经验证的管理员角色分配 PRİV8 工具与漏洞利用频道: https://t.me/+zuUQbKSrHgwyZmI0...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - 未经授权的权限提升 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 未经授权的权限提升 📌 概述 此仓库包含针对 CVE-2025-39459 的 Python 概念验证工具，影响 Real Estate 7 WordPress 主题版本 = 3.5.2。 该漏洞允许 未经授权的攻击者 注册一个新用户并将权限提升至 管理员 ，导致站点完全被攻陷。 产品: Real Estate 7 WordPress 主题 漏洞类型: 未经授权的权限提升 受影响版本: = 3.5.2 CVE:...

CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-101065 Obot Quickstart Docker Deployment Unauthenticated Admin Access

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped...

CVE-2025-71421

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

EUVD-2025-210977

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75169

The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is affected by an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi component. A remote authenticated user with the Admin role can exploit this flaw to upload files containing arbitrary content to hardcoded paths . No spe...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

PT-2026-85698

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...