CVE-2023-22432

CVE-2023-22432 web2pyの脆弱性（CVE-2023-22432）のPoC検証 web2py の脆弱性（CVE-2023-22432）が2023年1月31日（米国時間）に公開されました。この記事では、この脆弱性に関する検討と検証結果について説明します。 脆弱性の概要 この脆弱性は、web2pyのオープンリダイレクト脆弱性であり、管理ページのURLにおいてコールバック先URLとして任意のURLを指定できます。もともとオープンリダイレクト対策は実装されていましたが、URLに特別なバイパス手法を適用することで再現されます。これにより、悪意のあるサイトに誘導される可能性があります...

Next.js-Middleware-Bypass-CVE-2025-29927-

概要 @zhero の個人ブログ記事を読んだ後、どうやって動くのかを学ぶためにこのCTFを構築することにしました。その後、この脆弱性の悪用方法を学びたい人なら誰でも共有できるようにしました。zhero と inzo に多大な感謝を捧げます。彼らのブログ記事はこちらにあります: "https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware" 目標 ミドルウェアをバイパスして管理ページのフラグを見つける必要があります。また、素晴らしいAssetnoteの研究...

Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting. id: CVE-2022-0899 info: name: Header Footer Code Manager 1.1.24 - Cross-Site Scripting author:...

vulnerability-in-Remix-React-Router-CVE-2025-31137-

개요 @zhero의 개인 블로그 게시물에 있는 writeup을 읽은 후, 어떻게 작동하는지 배우기 위해 이 CTF를 만들기로 결정했고, 그 후 이 취약점을 악용하는 방법을 배우고 싶은 사람과 공유하기로 했습니다. [email protected] 버전으로 CTF를 만들려고 했지만, @remix-run/express를 확인했을 때 코드가 패치된 것을 발견하고 GitHub에서 취약한 코드를 복사하여 붙여넣었으므로 아래 설명대로 @remix-run/express 패키지의 코드를 변경해야 합니다. 목표 admin 페이지에서...

CVE-2026-81739

The Paytm Payment Gateway WordPress plugin (versions before 2.8.9 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape data received from payment callbacks before it is displayed on an admin page. Additionally, the integrity che...

CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

CVE-2026-102912

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102912 SourceCodester Online Leave Management System page reports sql injection

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102912 SourceCodester Online Leave Management System page reports sql injection

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

EUVD-2026-89607

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

EUVD-2026-82665

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin, in versions before 4.2.0 (specifically identified as 4.0.0-4.1.3 in some records), is vulnerable to Stored XSS . The root cause is a failure to validate submitted values against stored configurations for certain form types. This allows unauth...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

PT-2026-89108

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6 Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/...

CVE-2025-15694

The Joli Table Of Contents WordPress plugin, in versions 2.0.0 through 2.8.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape specific plugin settings before displaying them on an admin page. This allows high-privilege users, such as admi...

EUVD-2025-210850

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

CVE-2025-15694 Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...