CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - 未经授权的权限提升 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 未经授权的权限提升 📌 概述 此仓库包含针对 CVE-2025-39459 的 Python 概念验证工具，影响 Real Estate 7 WordPress 主题版本 = 3.5.2。 该漏洞允许 未经授权的攻击者 注册一个新用户并将权限提升至 管理员 ，导致站点完全被攻陷。 产品: Real Estate 7 WordPress 主题 漏洞类型: 未经授权的权限提升 受影响版本: = 3.5.2 CVE:...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

Duplicate-of-CVE-2023-26982

Trudesk 版本 1.2.6 漏洞说明： Trudesk 1.2.6 版本被发现存在一个存储型跨站脚本（XSS）漏洞，通过工单 创建/修改工单标签 功能，涉及管理员角色。 攻击向量： 攻击者需要进入设置菜单，选择工单，然后向下滚动找到工单标签。点击 创建，在 添加标签 输入框中插入 XSS 有效载荷，创建标签 即可利用存储型 XSS。保存后 XSS 有效载荷会立即执行。 受影响： http://IP:8118/settings/tickets POST /api/v1/tags/create Parameter : tag 有效载荷： 测试环境： 1. Trudesk 1.2.6 版...

CVE-2026-54807

CVE-2026-54807 CVE-2026-54807 WooCommerce 权限提升 ║ ║ 通过注册表单进行未经验证的管理员角色分配 PRİV8 工具与漏洞利用频道: https://t.me/+zuUQbKSrHgwyZmI0...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 El atacante envía una solicitud especialmente manipulada a la acción AJAX wpajaxnoprivwcfmajaxcontroller para modificar el formulario de registro de membresía y establecer el rol de registro al de administrador. Luego, el plugin procesa la solicitud y modifica el formulario de...

CVE-2026-75169

CVE-2026-75169 is an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user with Admin role can upload files with arbitrary content to hardcoded paths , enabling full compromise (CVSS 8.8 HIGH , C...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2025-15692

CVE-2025-15692 affects the Icegram Express WordPress plugin prior to version 5.8.6 . The root cause is improper escaping of a list description setting before it is output within an HTML attribute , enabling Stored Cross-Site Scripting (XSS) attacks. Exploitation requires an authenticated user wit...

EUVD-2026-64955

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was explicit...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76346

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76310

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76404

The Splunk MCP Server app deserializes stored credential data without type validation, allowing an admin-role user to trigger arbitrary OS command execution. Affected versions are below 1.2.1; no exploitation evidence is provided. Update to version 1.2.1 to remediate. Splunk advisory: https://adv...

CVE-2026-76404 Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76346 Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

CVE-2026-76327

CVE-2026-76327 is an SPL injection vulnerability in Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (below 3.10.9, 3.9.23, 3.8.70). The root cause is that Secure Gateway dashboards fail to neutralize caller-supplied values before embedding them in dashboard sear...

CVE-2026-76310 Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

PT-2026-78768

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store malicious Search...

PT-2026-78831

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.2.1 Description Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management componen...