Lucene search
+L

666 matches found

Kitploit
Kitploit
•added 2026/09/24 11:15 p.m.•9 views

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - 未認証の権限昇格 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 未認証の権限昇格 📌 概要 このリポジトリには、CVE-2025-39459 のPython概念実証ツールが含まれています。この脆弱性は、Real Estate 7 WordPressテーマのバージョン 3.5.2以下 に影響します。 この脆弱性により、未認証の攻撃者 が新しいユーザーを登録し、権限を管理者 に昇格させることができ、サイト全体の乗っ取りにつながります。 製品: Real Estate 7...

7.3CVSS7.9AI score0.00383EPSS
SaveExploits3
NVD
NVD
•added 2026/09/21 2:17 p.m.•8 views

CVE-2025-71421

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

8.6CVSS0.00441EPSS
SaveExploits0References7
CVE
CVE
•added 2026/09/21 1:43 p.m.•15 views

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

8.6CVSS5.9AI score0.00441EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
•added 2026/09/21 1:43 p.m.•8 views

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

8.6CVSS5.9AI score0.00441EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/09/21 1:43 p.m.•6 views

EUVD-2025-210977

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

8.6CVSS5.9AI score0.00441EPSS
SaveExploits0References7
Kitploit
Kitploit
•added 2026/09/21 12:26 p.m.•11 views

Duplicate-of-CVE-2023-26982

Trudesk バージョン 1.2.6 脆弱性の説明: Trudesk バージョン 1.2.6 には、管理者ロールのチケット Create/Modify Ticket Tags を介した保存型クロスサイトスクリプティング XSS の脆弱性が含まれていることが判明しました。 攻撃ベクトル: 攻撃者は Settings メニューに移動し、tickets を選択してから下にスクロールして Ticket Tags を見つけなければなりません。保存型 XSS を悪用するには、CREATE をクリックし、Add Tags 入力に XSS ペイロードを挿入して Create Tag を実行します。XS...

5.4CVSS6.2AI score0.01018EPSS
SaveExploits1
NVD
NVD
•added 2026/09/20 7:16 a.m.•16 views

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

6.6CVSS0.00357EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/20 6:00 a.m.•8 views

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

6.6CVSS5.8AI score0.00357EPSS
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/19 4:18 p.m.•11 views

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 공격자는 wpajaxnoprivwcfmajaxcontroller AJAX 액션에 특별히 조작된 요청을 전송하여 멤버십 등록 양식을 수정하고 등록 역할을 관리자로 설정합니다. 그런 다음 플러그인은 해당 요청을 처리하고 사용자가 관리자 역할로 등록할 수 있도록 멤버십 등록 양식을 수정합니다. 공격자는 수정된 멤버십 등록 양식을 제출하여 관리자 역할로 새로운 사용자로 등록할 수 있습니다...

9.8CVSS8.4AI score0.02099EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/19 10:37 a.m.•12 views

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 権限昇格 ║ ║ 未認証の管理者ロール割り当て(登録フォーム経由) PRİV8 ツールとエクスプロイトチャンネル: https://t.me/+zuUQbKSrHgwyZmI0...

9.8CVSS5.9AI score0.00483EPSS
SaveExploits1
OSV
OSV
•added 2026/09/10 11:04 p.m.•10 views

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

6.5CVSS5.7AI score0.00371EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/10 12:00 a.m.•15 views

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

6.5CVSS5.7AI score0.00371EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/09/09 8:28 a.m.•13 views

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

8.8CVSS5.7AI score0.00239EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/04 12:00 a.m.•1 views

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

8.8CVSS6AI score0.00716EPSS
SaveExploits0References2
CVE
CVE
•added 2026/09/04 12:00 a.m.•37 views

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

8.8CVSS5.6AI score0.00716EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/04 12:00 a.m.•36 views

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

0.00716EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/04 12:00 a.m.•15 views

PT-2026-85698

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

5.6AI score0.00716EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/02 2:16 p.m.•14 views

CVE-2025-15692

CVE-2025-15692 affects the Icegram Express WordPress plugin prior to version 5.8.6 . The root cause is improper escaping of a list description setting before it is output within an HTML attribute , enabling Stored Cross-Site Scripting (XSS) attacks. Exploitation requires an authenticated user wit...

3.5CVSS5.9AI score0.00168EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/08/24 4:11 p.m.•13 views

EUVD-2026-64955

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was explicit...

9.3CVSS5.4AI score0.00773EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/19 10:17 p.m.•28 views

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

9.1CVSS0.00749EPSS
SaveExploits0References1
Rows per page
Query Builder