CVE-2022-38813

CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or...

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Admin dashboard start param: root@kitploit: POST http://cvefarm.local/admin/dashboard...

CVE-2026-25595

CVE-2026-25595 — Stored XSS via Invoice Number in InvoicePlane 1.7.0 Vulnerability: Stored Cross-Site Scripting XSS via Invoice Number field Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Medium CVSS 3.1 Score: 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CW...

CVE-2026-7401-XSS

Stored XSS in CET Automated Grading System — Student Registration Unauthenticated → Admin Dashboard Details...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC This repository contains the Proof of Concept PoC for the unauthenticated Remote Code Execution RCE vulnerability in EITS Admin Dashboard v2.4.0 CVE-2026-31367. The vulnerability occurs due to a flaw in input sanitization on the /api/v1/debu...

CVE-2025-65271

CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364

CVE-2026-78364 affects the MW WP Form WordPress plugin in versions prior to 5.1.6 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by failure to sanitize and escape form settings before outputting them in an admin dashboard page, specifically via the Inquiry Data List . An authen...

CVE-2026-15604

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-15604

The CVE-2026-15604 entry concerns the Toocheke Companion WordPress plugin. It describes a Stored Cross-Site Scripting (Stored XSS) flaw in versions up to 2.10, caused by insufficient input sanitization in toocheke_series_bg_color_save() (stores raw $_POST in post meta) and inadequate output escap...

EUVD-2026-59893

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

PT-2026-73107

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series bg color' post meta field. This is due to insufficient input sanitization in the toocheke series bg color save function which stores the raw $ POST value...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...