111897 matches found
Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeitarticlespaginationcallback function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for...
PT-2026-108202
Name of the Vulnerable Software and Affected Versions Dromara Skyeye versions prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 Description A missing authentication issue exists in the bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false...
PT-2026-107842
A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...
PT-2026-108020
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue...
Exploit for CVE-2025-58226
CVE-2025-58226 — 3D FlipBook ≤ 1.16.16 Unauthenticated Sensiti...
CVE-2022-21661
ماسح WordPress CVE-2022-21661 الاستخدام python wordpressscanner.py -H -p -ssl -proxy -path المساعدة ماسح WordPress لـ CVE-2022-21661 options: -h, --help عرض رسالة المساعدة هذه والخروج -H HOST, --host HOST المضيف أو عنوان IP -p PORT, --port PORT رقم المنفذ -ssl, --sslsupport دعم SSL/TLS -proxy...
CVE-2026-38526
CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Avertissement légal : ce code est fourni à des fins éducatives et pour des tests autorisés uniquement CTF, bug bounty, labo privé. L'auteur n'est pas responsable d'une utilisation illégale. Description Krayin CRM Webkul ≤ 2.2.x expose...
CVE-2026-34990
CVE-2026-34990 — élévation de privilèges locale dans CUPS cups2root, dé-harnaché CVSS 3.x : 8.4 HIGH approx — verify CWE : CWE-287 Improper Authentication + CWE-269 Improper Privilege Mgmt Fix : CUPS 2.4.17+ Affects : CUPS ≤ 2.4.16 with cupsd running as root and 631 reachable locally Élévation de...
EUVD-2026-92632
Ghost: Stored XSS via Embed Card Previews...
Ghost : Stored XSS via SVG Files in Content Imports
Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...
GHSA-HQQ2-XQR2-FMX2 Ghost : Stored XSS via SVG Files in Content Imports
Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...
EUVD-2026-92633
Ghost : Stored XSS via SVG Files in Content Imports...
EUVD-2026-92760
Ghost: Stored XSS via oEmbed Photo Responses...
Ghost: Stored XSS via oEmbed Photo Responses
Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...
GHSA-V3XR-G6P2-FVGV Ghost: Stored XSS via oEmbed Photo Responses
Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...
EUVD-2026-92761
Ghost: Stored XSS via Bookmark Card Images...
GHSA-53VV-XM9F-MM82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API
Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...
NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API
NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 0.7.2, 6.64.0...