CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

CVE-2025-57819_FreePBX

🛡️ CVE-2025-57819 – Iniezione SQL non autenticata in FreePBX verso RCE PoC Questo repository contiene due script Proof-of-Concept PoC in Python che mirano a CVE-2025-57819 , una vulnerabilità critica di iniezione SQL non autenticata in FreePBX. 🧠 Informazioni sulla vulnerabilità CVE-2025-57819...

CVE-2026-78003

The Mailgun for WordPress plugin (versions up to and including 2.2.0 ) is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. The root cause is insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes t...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-16260

CVE-2026-16260 is a stored XSS vulnerability in the Post Grid, Slider & Carousel Ultimate WordPress plugin (versions before 1.8.1 ). The plugin fails to sanitise and escape the Header Title custom post type setting before outputting it in an HTML attribute on the admin edit screen. This allows au...

CVE-2025-68860

CVE-2025-68860 Il plugin WordPress Mobile builder La vulnerabilità Authentication Bypass Using an Alternate Path or Channel in Mobile Builder consente l'abuso dell'autenticazione. Questo problema riguarda Mobile builder da n/a fino alla 1.4.2. Punteggio CVSS: 9.8 CRITICO Vettore:...

DotCMS-CVE-2022-45782

CVE-2022-45782 – Previsibilidade do Token de Redefinição de Senha do dotCMS PoC Este repositório contém uma prova de conceito de exploração para CVE-2022-45782, uma vulnerabilidade no dotCMS onde os tokens de redefinição de senha são gerados usando o método não criptográfico...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-49849

xShop is an open-source e-commerce platform built with Laravel . Version 3.0.3 contains an Unrestricted File Upload vulnerability in the File Attachment Module within the Admin panel. An authenticated administrator can upload executable files (e.g., .php), enabling Remote Code Execution (RCE) and...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

DccwBypassUAC

DccwBypassUAC Questo exploit sfrutta il modo in cui "WinSxS" viene gestito da "dccw.exe", tramite un metodo derivato dal "Bypass UAC" di Leo Davidson, al fine di ottenere una shell di amministratore senza richiedere il consenso. Supporta le architetture "x86" e "x64". Inoltre, è stato testato con...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

CVE-2026-75933

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75932

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

EUVD-2026-63998

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75933

Jet Admin is vulnerable to a stored cross-site scripting (XSS) flaw in the sign-in page's scripts and styles option. An authenticated attacker can inject arbitrary JavaScript that executes in the context of any visiting user's domain, enabling session hijacking, data exfiltration, or further comp...