CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x تنفيذ تعليمات برمجية عن بُعد بعد المصادقة ⚠️ تنبيه قانوني : هذا الكود مُقدَّم لأغراض تعليمية وللاختبارات المصرَّح بها فقط CTF، bug bounty، مختبر خاص. المؤلف غير مسؤول عن أي استخدام غير قانوني. الوصف Krayin CRM Webkul ≤ 2.2.x يكشف عن نقطة النهاية...

CVE-2026-34990

CVE-2026-34990 — تصعيد الصلاحيات المحلي في CUPS cups2root، بعد إزالة بيئة الاختبار CVSS 3.x : 8.4 HIGH تقريبي — تحقق منه CWE : CWE-287 مصادقة غير صحيحة + CWE-269 إدارة صلاحيات غير صحيحة الإصلاح : CUPS 2.4.17+ يؤثر على: CUPS ≤ 2.4.16 مع تشغيل cupsd كـ root والمنفذ 631 متاح محلياً تصعيد صلاحيات محل...

EUVD-2026-92632

Ghost: Stored XSS via Embed Card Previews...

GHSA-HQQ2-XQR2-FMX2 Ghost : Stored XSS via SVG Files in Content Imports

Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...

Ghost : Stored XSS via SVG Files in Content Imports

Impact SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. Vulnerable versions This vulnerability is...

EUVD-2026-92633

Ghost : Stored XSS via SVG Files in Content Imports...

GHSA-V3XR-G6P2-FVGV Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...

EUVD-2026-92760

Ghost: Stored XSS via oEmbed Photo Responses...

Ghost: Stored XSS via oEmbed Photo Responses

Impact Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. Vulnerable...

EUVD-2026-92761

Ghost: Stored XSS via Bookmark Card Images...

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

GHSA-53VV-XM9F-MM82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 0.7.2, 6.64.0...

Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

GHSA-V6Q3-XQXM-6F5V Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

NPM: Ghost: Invite Token Disclosure in Ghost Admin API

NPM: Ghost: Invite Token Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 4.39.0, 6.64.0...

CMS-Made-Simple-2.2.9-CVE-2019-9053

अस्वीकरण यह रिपॉजिटरी एक पायथन 3 संगत शोषण प्रदान करती है जो CMS Made Simple संस्करण 2.2.9 और उससे पहले के संस्करणों में एक अप्रमाणित SQL इंजेक्शन भेद्यता को लक्षित करती है। CVE-2019-9053 के रूप में ट्रैक की गई यह खामी, हमलावरों को संवेदनशील प्रशासक डेटा, जिसमें उपयोगकर्ता नाम, हैशेड पासवर्ड, ईमे...

CVE-2024-27198_Lab

CVE-2024-27198Lab Vulnerability Research & Purple Team Demonstration Lab for JetBrains TeamCity Authentication Bypass CVE-2024-27198 Table of Contents About The Project CVE Details Built With Threat Intelligence & OSINT Real-World Impact & Exploitation Why this CVE is Critical Getting Started...

7zip-CVE-2025-11001

उपयोग: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe 7-zip का शोषण यह भेद्यता केवल विंडोज़ पर शोषणीय है और इसकी एक बड़ी सीमा है। इस बग का सफलतापूर्वक शोषण तभी किया जा सकता है जब 7-Zip व्यवस्थापक विशेषाधिकारों Admin privileges के साथ चलाया जाए। ऐसा इसलिए है क्योंकि...

EUVD-2026-94455

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...