EXOS < 31.7.4 / 32.0.0 < 32.7.4.15 / 33.0.0 < 33.1.100, 33.7.0 < 33.7.1 Privilege Escalation (SA-2026-088)

The version of EXOS installed on the remote host is missing a security update. It is, therefore, affected by an privilege escalation vulnerability. - ExtremeXOS shell environment utilities fail to safely canonicalize paths and can follow symbolic links from a writable user directory to a privileg...

PT-2026-98766

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls u32: fix duplicate handle when node ID pool is exhausted gen new kid falls back to returning max htid | 0xFFF when both idr alloc u32 ranges are full, instead of reporting an error. u32 change trusts that value and...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

CVE-2026-97646: Authorization Bypass Through User-Controlled Key

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out...

CVE-2026-96448: Improper Authorization

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-63216: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

PT-2026-99129

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to revoke administrative privileges immediately after a role downgrade. This occurs because the Admin Controller relies on the user type snapshot stored in an active session...

PT-2026-99095

Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists within the Upload Functionality component. The flaw is located in the ConfigurationForm::rules function of the...

PT-2026-98321

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions prior to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description An authorization bypass exists in the file admin/fun/getStudent.php. A remote attacker can exploit this by manipulating the sid argumen...

CVE-2026-63205: Authorization Bypass Through User-Controlled Key

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies th...

PT-2026-99100

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-197 Description A path traversal issue exists in the admin template editor. Authenticated administrators with manage template access permission can use directory traversal sequences in the folder parameter to...

PT-2026-98990

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

PT-2026-99084

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Unsanitized option labels are rendered as raw HTML without escaping in the configuration dialogs of AI Agents within the admin UI. An attacker can inject arbitrary HTML and JavaScript by controlling a...

CVE-2026-100372: Improper Limitation of a Pathname to a Restricted Directory

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS Exploit Description This repository hosts an automated Proof-of-Concept PoC exploit for CVE-2025-8550 , a reflected Cross‑Site Scripting XSS vulnerability in atjiu pybbs ≤ v6.0.0. It targets the /admin/topic/list endpoint’s username parameter, which lacks proper...

CVE-2021-46398

CVE-2021-46398 - Lalie ARNOUD, Gaspard ANDRIEU In this repository, you will find a proof of concept of the exploitation of the CVE-2021-46398 flaw through a docker compose, as well as an analysis of the impacts of this flaw on information systems. Exploit Title: FileBrowser 2.17.2 - Cross Site...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability Exploit Author: ugurkarakoc Vendor Homepage https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Software Link https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Overview...

CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC

CVE-2020-29607 — Pluck CMS Authenticated remote code execution in Pluck CMS before 4.7.13. The admin file manager admin.php?action=files does not validate file extensions, allowing upload of .phar files which Apache executes as PHP. Uploading a webshell through this endpoint results in RCE as the...

CVE-2025-10307

Exploit: Arbitrary File Deletion via Backuply tarfile path traversal Browser Console PoC authenticated admin async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await fetchpage, credentials: 'same-origin'...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Unauthenticated Privilege Escalation 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Unauthenticated Privilege Escalation 📌 Overview This repository contains a Python proof-of-concept tool for CVE-2025-39459 , affecting the Real Estate 7 WordPress theme in versions...