CVE-2026-101928 Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

CVE-2026-41452-PoC

CVE-2026-41452 — Krayin CRM インストーラーの認証バイパス → 管理者乗っ取り CVSS 9.8（Critical） · CWE-287 / CWE-306 · Jiva の解説 · VulnCheck 概要 Krayin CRM のインストーラーは、POST /install/api/admin-config-setup（および run-migration、run-seeder）を CSRF 保護なしで （withoutMiddleware'web' グループ）公開しています。CanInstall グローバルミドルウェアは、非 AJAX...

CVE-2025-67315

CSRF による任意従業員の無効化 概要 従業員管理 機能にはクロスサイトリクエストフォージェリ CSRF の脆弱性があります。 攻撃者はログイン済みの管理者をだまして、管理者の知らないうちに同意なく従業員（例：inid=1）を無効化する偽装リクエストを送信させることができます。 CVSS 基本スコア: 5.4（MEDIUM） ベクトル文字列: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L 影響を受ける機能 モジュール: 管理パネル → 従業員 → 従業員管理 アクション: 従業員の無効化（inid パラメータ経由） 再現手順 1...

CVE-2026-15989

█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗ ██████╗ ██████╗ ████████╗ ██╔══██╗ ████╗ ██║ ╚══██╔══╝ ██║ ██╔══██╗ ██╔═████╗ ██╔═████╗ ╚══██╔══╝ ███████║ ██╔██╗ ██║ ██║ ██║ ██║ ██║ ██║██╔██║ ██║██╔██║ ██║ ██╔══██║ ██║╚██╗██║ ██║ ██║ ██║ ██║ ████╔╝██║ ████╔╝██║ ██║ ██║ ██║ ██║ ╚████║ ██║ ██║ ██████╔╝...

CVE-Newgen-Software-Advisories

Newgen Software – CVE 개념 증명 이 저장소에는 Newgen Software Technologies Limited 이 개발한 제품에서 발견된 여러 CVE 취약점 에 대한 개념 증명PoC 자료와 기술 문서가 포함되어 있습니다. 여기에 문서화된 취약점은 공개적으로 할당된 CVE이며 MITRE와 NVD에서 참조됩니다. 포함된 CVE CVE-2025-65742 – Newgen OmniDocs LDAP 관리자 기능 수준 권한 위반 BFLA CVE-2025-69907 – Newgen OmniDocs 인증되지 않은 정보 공...

CVE-2023-3460_POC

CVE-2023-3460 CVE-2023-3460 익스플로잇 - Ultimate Member 플러그인의 무단 관리자 액세스. Golang으로 제작됨 ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ 면책 조항 ║ ║ 프로젝트 소개 ║ ║ ║ ║ ║ ║ 이 개념 증명PoC은 교육 및 연구 목적으로만 ║ ║ 이 익스플로잇을 사용할 때 일부 경우 문제가 ║ ║ 개발되었습니다. 잠재적인 보안...

cve-2025-24472-fortinet_authbypass_reproduction

CVE-2025-24472 — Fortinet FortiOS / FortiProxy 認証バイパス 概要 CVE-2025-24472 は、Fortinet FortiOS および FortiProxy における認証バイパスの脆弱性です。認証されていない攻撃者は、特別に細工された CSF Central Security Fabric プロキシリクエストを作成し、影響を受けるデバイス上でスーパー管理者権限を取得できます。この欠陥の CVSS スコアは 8.1 で、SuperBlack Mora001 を含むランサムウェアグループによって活発に悪用されていることが知られています。...

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2023-7028

CVE-2023-7028 | 계정 탈취 Gitlab 면책 조항 이 코드는 취약점의 개념 증명이며, 소유하지 않은 Gitlab 인스턴스에서 사용하도록 권장하는 것이 아닙니다. 이 도구는 연구 및 교육 목적으로만 개발되었으며, 이 도구를 사용하여 발생하는 모든 행위에 대해 책임을 지지 않습니다. 설명 이 저장소는https://github.com/Vozec/CVE-2023-7028의 포크입니다. 저는 단지 익스플로잇 사용법을 개선했을 뿐입니다. CVE-2023-7028은 사용자 상호작용 없이 Gitlab 관리자 계정을 장악할 수 있...

EUVD-2026-91876

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270

The Ultimate Member plugin for WordPress (versions up to and including 2.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'form_id' parameter. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-75816

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75816 CVE-2026-75816 Frontend Admin by DynamiApps 3.29.11 - shabti I am @abraxasnull. Loopback lab. The client is CVE-2026-75816-Abraxas-Labs.py. user1 is not a post. Unauthenticated admin-ajax.php...

CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924 MFAバイパス WordPress - エクスプロイトラボ このリポジトリは、WordPress の CVE-2024-10924 脆弱性を悪用して、二要素認証（MFA）をバイパスし、WordPress 管理パネルへのアクセスを取得するためのラボを提供します。 前提条件 このラボを自分の環境に展開するには、以下の手順に従ってください。 VMware に WordPress をデプロイする LAB の zip を解凍し、VMware で Open をクリックしてマシンをインポートします。Ubuntu-Bypass-MFA-Wordpress.vmx...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify 任意ファイルアップロード Request a Quote for WooCommercewoocommerce-request-a-quote、Addify / WooCommerce.comにおける CVE-2026-18143 のPython 3 PoCです。 説明 PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 は、afrfqsubmitquoteviapopup を介した...

CVE-2026-104474

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

CVE-2026-101928: Improper Neutralization of Input During Web Page Generation

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Rocky Linux 9 [CIQ] Security Update: gvfs / gvfs-client / gvfs-client-debuginfo / gvfs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_74370)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674370 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

CVE-2026-96270: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-104474: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...