CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - 未認証の権限昇格 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 未認証の権限昇格 📌 概要 このリポジトリには、CVE-2025-39459 のPython概念実証ツールが含まれています。この脆弱性は、Real Estate 7 WordPressテーマのバージョン 3.5.2以下 に影響します。 この脆弱性により、未認証の攻撃者 が新しいユーザーを登録し、権限を管理者 に昇格させることができ、サイト全体の乗っ取りにつながります。 製品: Real Estate 7...

CVE-2025-71421

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

EUVD-2025-210977

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...

Duplicate-of-CVE-2023-26982

Trudesk バージョン 1.2.6 脆弱性の説明: Trudesk バージョン 1.2.6 には、管理者ロールのチケット Create/Modify Ticket Tags を介した保存型クロスサイトスクリプティング XSS の脆弱性が含まれていることが判明しました。 攻撃ベクトル: 攻撃者は Settings メニューに移動し、tickets を選択してから下にスクロールして Ticket Tags を見つけなければなりません。保存型 XSS を悪用するには、CREATE をクリックし、Add Tags 入力に XSS ペイロードを挿入して Create Tag を実行します。XS...

CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 공격자는 wpajaxnoprivwcfmajaxcontroller AJAX 액션에 특별히 조작된 요청을 전송하여 멤버십 등록 양식을 수정하고 등록 역할을 관리자로 설정합니다. 그런 다음 플러그인은 해당 요청을 처리하고 사용자가 관리자 역할로 등록할 수 있도록 멤버십 등록 양식을 수정합니다. 공격자는 수정된 멤버십 등록 양식을 제출하여 관리자 역할로 새로운 사용자로 등록할 수 있습니다...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 権限昇格 ║ ║ 未認証の管理者ロール割り当て（登録フォーム経由） PRİV8 ツールとエクスプロイトチャンネル: https://t.me/+zuUQbKSrHgwyZmI0...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

PT-2026-85698

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2025-15692

CVE-2025-15692 affects the Icegram Express WordPress plugin prior to version 5.8.6 . The root cause is improper escaping of a list description setting before it is output within an HTML attribute , enabling Stored Cross-Site Scripting (XSS) attacks. Exploitation requires an authenticated user wit...

EUVD-2026-64955

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was explicit...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...