CVE-2026-104474: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

PT-2026-104501

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

CVE-2026-96270: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

PT-2026-104487

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-104474

OpenLiteSpeed versions prior to 1.9.3 are susceptible to a local privilege escalation vulnerability within the admin/misc/lsup.sh script. The root cause is the execution of unverified update packages from a directory (/usr/local/lsws/autoupdate/) that is writable by the nobody user. An attacker w...

CVE-2022-26923_AD-Certificate-Services

CVE-2022-26923 AD Certificate Services Date of publication : 10/05/2022 Attack complexity: Low Privileges required: Low CVSS Score : 8.1 The vulnerability allowed a low-privileged user to escalate privileges to domain administrator in a default Active Directory environment with the Active Directo...

bw-dump

BW-Dump Updated 2 : This vulnerability was assigned CVE-2023-38840. Updated : A patch was released on GitHub pull request 5813 which fixes the vulnerability. The affected versions are Bitwarden Desktop 2023.7.0 and below. Description A proof-of-concept tool that extracts the master password from ...

CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory Unauthenticated Authentication Bypass Mass Exploit -red.svg Critical Authentication Bypass CVSS 9.8 — Actively Exploited in the Wild This tool is a mass exploit for CVE-2026-82329, a vulnerability that allows an unauthenticated attacker with network access to...

p2p

P2P Remote Desktop Remote Desktop P2P based - Portable, No Configuration or Installation Needed. How it works Compile and Open p2p.exe as admin in 2 different PC's. Copy the My Lan or Wan IP and communicate it to other peer and vice versa. The 2 peers have now the 2 endpoint to connect to, so pre...

CVE-2026-19952

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-19952 CVE-2026-19952 Frontend Admin by DynamiApps 3.29.12 - DynamiApps I am @abraxasnull. Loopback lab. The client is CVE-2026-19952-Abraxas-Labs.py. The title is the path. Unauthenticated movefolders on...

CVE-2025-3102

🔐 CVE-2025-3102 – Authentication Bypass in SureTriggers WordPress Plugin 🚨 CVE-2025-3102 is a critical authentication bypass vulnerability affecting the SureTriggers: All-in-One Automation Platform WordPress plugin, which is actively installed on over 100,000 websites. Due to the nature of the fl...

CVE-2021-21014

PoC Limited CVE-2021-21014 Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Affected version: = Magento 2.4.1 User...

CVE-2026-7654

CVE-2026-7654 CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Insecure Password Reset Mechanism → Full Admin Account Takeover Plaintext Password Reset Keys Stored in Database + SQL Injection = Complete Admin Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership...

CVE-2020-10129

CVE-2020-10129 - SearchBlox product before V-9.2 is vulnerable to Privileged Escalation-Lower user is able to access Admin Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure...

CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...