CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

EUVD-2026-74566

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2025-45619

Issue details Camera model PTC310UV2 running firmware version 0.1.0000.59. The vulnerability is found in the web interface that is used to access the camera. The vulnerability was found during a penetration test, thus, certain information in the PoC screenshots have been redacted. Description Thi...

CVE-2023-22515-Exploit-Script

CVE-2023-22515 자동 익스플로잇 - Confluence 권한 상승 이 저장소는 Atlassian Confluence의 치명적인 취약점인 CVE-2023-22515에 대한 자동 익스플로잇 스크립트를 포함합니다. 이 취약점은 인증되지 않은 공격자가 관리자 계정을 생성하고 취약한 인스턴스를 완전히 제어할 수 있게 합니다. 이 스크립트는 단일 대상 및 대량 익스플로잇 모드를 모두 지원하여 침투 테스터와 보안 연구자에게 적합합니다. 특징 자동 익스플로잇 – 취약점을 트리거하고 관리자 계정을 생성하는 완전 자동화 프로세스. 단...

CVE-2019-19550

CVE-2019-19550 Description Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL. Important Dates Announcement to Vendor: 2019-12-02 Public...

cve-2022-24112

Apache APISIX 2.12.1 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples. In this docker-compose.yml file, we already change into image: apache/apisix:2.12.0-alpine, because the vulnerability in this version, then let's...

ABO.CMS-Login-SQLi-CVE-2024-25227

ABO.CMS-Login-SQLi-CVE-2024-25227 Unauthenticated SQLi and Login Bypass CVE-2024-25227 Date: 23/02/2024 Tested on ABO.CMS 5.8 Vendor: ABO.CMS Vendor URL:https://abocms.ru ABO.CMS 5.8 is vulnerable to SQL Injection via the tblogin parameter, admin login page. The affected component is "tblogin"...

cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — JFrog Artifactory 未認証の認証バイパス → 管理者乗っ取り CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · 2026-08-28 公開 · 実環境で悪用済み。 未認証のネットワーク隣接攻撃者が、デフォルト設定のセルフホスト型 JFrog Artifactory に対してプラットフォーム管理者アクセストークン を発行できます。このディレクトリには、再現可能な Docker ラボと、URL パラメータ化された検証用 PoC が含まれています。 artifactory-oss...

CVE-2023-42791_CVE-2024-23666

Fortimanager insufficient authorization checks CVE-2024-23666 and unrestricted file upload CVE-2023-42791 exploitation scripts Two exploitation scripts leveraging these vulnerabilities are provided: rce.py: Provides a reverse shell or adds an arbitrary administrator from unprivileged access to th...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator t...

PT-2026-89175

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

PT-2026-89057

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp handle upload that disables WordPress core's file type...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...

PT-2026-88958

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2018-12633-TPLink-Auth-Bypass

CVE-2018-12633-TPLink-Auth-Bypass A technical case study and exploitation analysis of the Authentication Bypass vulnerability in TP-Link TL-WR840N firmware CVE-2018-12633. Vulnerability Analysis: TP-Link TL-WR840N Authentication Bypass CVE-2018-12633 ⚠️ Disclaimer: This repository is for...

TendaSpill

TendaSpill An exploitation tool to extract passwords using CVE-2015-5995. CVE-2015-5995 Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User How to use This script using Python3. Install requirements pip install -r requirements.txt Reference https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...

CVE-2026-85982

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...