CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

CVE-2021-38602

CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...

CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc root@kitploit: history.pushState'', '', '/' Success:...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...

service-now

service-now Service-Now Article Bruteforcer The idea here is that there is misconfiguration with articles and could expose sensitive information. Any Issues raise the it here - https://github.com/RandomRobbieBF/service-now/issues or submit a PR! How to Use root@kitploit: python3 service-now.py -u...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview...

CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

CVE-2026-77034

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034

CVE-2026-77034 affects the Joomla Event Manager extension (versions prior to 5.0.1 ). The vulnerability allows an unauthenticated visitor holding their own session token to republish and overwrite an article associated with an event, resulting in an integrity impact rated Low (CVSS 4.0 score: 6.9...

EUVD-2026-66865

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75049

JetBrains YouTrack (versions before 2026.1.13903 and 2026.2.17950) has an authorization flaw: an authenticated user with low privileges can use the draft creation endpoint to read restricted articles from other projects, causing high confidentiality impact (CVSS 6.5). No in-the-wlood exploitation...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

EUVD-2026-54963

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375

CVE-2026-19375 affects dmitriiweb article-scraper-mcp 1.0.0. The vulnerability is in the function fetch_article (file: news_scraper_mcp/server.py); manipulating the argument url results in server-side request forgery . Attack can be performed remotely and the exploit is public. The reports note t...