CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

CVE-2025-57520 – Stored XSS in Decap CMS Steps 1. Login as Contributor/Editor low privilege. 2. Create a new blog entry. 3. Insert the payload into one of the vulnerable fields e.g., title. 4. Save the entry. 5. Login as Admin high privilege. 6. Open the entry in Preview. 7. Payload executes in t...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Command Injection PoC Vulnerability Description: The ping and traceroute functions of the NETIS SYSTEMS Router WF2409E version V3.6.42541 are susceptible to command injection attacks. Malicious input can be crafted in the parameters of the...

codecentric__spring-boot-admin_CVE-2022-46166_2-6-9

codecentric's Spring Boot Admin This community project provides an admin interface for Spring Boot ® applications. Monitoring Python applications is available using Pyctuator. Spring Boot Admin provides the following features for registered applications: Show health status Show details, like JVM ...

Admin-Panel_Finder

Chercheur de Panneau d'Administration Une extension burp suite qui énumère les interfaces d'administration de l'infrastructure et de l'application. Références OWASP : Classification : Tests de sécurité des applications web 02-Tests de gestion de configuration et de déploiement OTG v4 : OWASP...

magnolia-rce

Название эксплойта: Magnolia DX Core 6.3.8 - Внедрение команд Дата: 05/16/2025 Автор эксплойта: tmrswrr Версия: 6.3.8 Домашняя страница вендора: https://docs.magnolia-cms.com/home/ Продукт: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

CVE-2026-36960

CVE-2026-36960: Межсайтовая подделка запроса CSRF в веб-интерфейсе управления Идентификатор CVE: CVE-2026-36960 Дата: 2026-04-29 Обнаружил: Kirubel Solomne Производитель: U-SPEED Продукт: Маршрутизатор U-SPEED Версия прошивки: V1.0.0 CWE: CWE-352 — Межсайтовая подделка запроса CSRF Описание...

cpanel-control-plane-exposure-check

Проверка экспонирования контрольной панели cPanel Легковесная утилита проверки безопасности для выявления доступных из интернета административных интерфейсов cPanel, WHM и webmail на внешних поверхностях атаки. Утилита выполняет проверку сервисов, классификацию экспонирования, анализ HTTP-ответов...

CVE-2025-56311

CVE-2025-56311: Avis de sécurité – Vulnérabilité CSRF dans la fonction de redémarrage du routeur FD602GW-DX-R410 Preuve de concept et avis de sécurité pour une vulnérabilité de type Cross-Site Request Forgery CSRF dans l'interface d'administration du routeur fibre FD602GW-DX-R410 Firmware V2.2.14...

CVE-2026-36436-Public-Reference-Pack

CVE-2026-36436-Public-Reference-Pack Résumé Une vulnérabilité dans Trisolutions BRPerfX version 1.4.4.0 expose les identifiants LDAP en texte clair dans l'interface de configuration administrative. Un administrateur authentifié peut inspecter le code côté client à l'aide des outils de développeme...

CVE-2025-14340

XSS до захвата учетной записи администратора CVE-2025-14340 Уязвимость межсайтового скриптинга XSS в интерфейсе управления REST Payara позволяет выполнять JavaScript, контролируемый злоумышленником, что приводит к захвату учетной записи администратора. Это происходит из-за: 1. Панель использует...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

EUVD-2026-76744

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90449

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90456 Use of default credentials in Malcolm

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

CVE-2026-90456

CVE-2026-90456 affects a bundled inventory-management component whose example environment-configuration file ships with a fixed, publicly-known administrative password . If a deployment copies this example file into active configuration without running the setup routine that regenerates credentia...

CVE-2026-90449 Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90449

CVE-2026-90449 affects a reverse proxy/gateway in an ICS/OT deployment (per the referenced CISA advisory icsa-26-254-01 ). When a particular authentication mode is configured, the reverse proxy forwards requests to a bundled third-party administrative interface without first applying the gateway'...

CVE-2026-90449 Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

PT-2026-90525

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...