CVE-2026-54721

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

EUVD-2026-67229

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

EUVD-2026-67167

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721 Silverstripe UserForms: Remote code execution via userforms email subject

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

CVE-2026-54721

Silverstripe UserForms (a visual form builder module for Silverstripe CMS) contains a remote code execution vulnerability in the email recipient subject field. Between versions 6.0.0 and the fixed releases, a specially crafted payload in the subject field is interpreted as executable server-side ...

CVE-2021-21551

CVE-2021-21551 Dell Treiber EoP CVE-2021-21551 Beschreibung Der Dell-Treiber dbutil23.sys enthält eine Schwachstelle durch unzureichende Zugriffskontrolle, die zu einer Erhöhung von Privilegien, Denial-of-Service oder Offenlegung von Informationen führen kann. Erforderlich ist ein lokaler,...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 Sommario È stata scoperta una vulnerabilità nelle versioni di SCM Manager 1.2 = 1.60 che consente a un attaccante precedentemente autenticato con permessi di scrittura di eseguire codice JavaScript in campi specifici. Questa Proof of Concept è stata...

EUVD-2026-67143

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2023-34212

CVE-2023-34212: Deserializzazione Java tramite componenti JNDI in Apache NiFi Il Controller Service JndiJmsConnectionFactoryProvider insieme ai Processor ConsumeJMS e PublishJMS, in Apache NiFi dalla versione 1.8.0 alla 1.21.0, consentono a un utente autenticato e autorizzato di configurare...

CVE-2019-1332

CVE-2019-1332: Cross-Site Scripting Riflesso in Microsoft SQL Server Reporting Services Esiste una vulnerabilità di cross-site scripting XSS quando Microsoft SQL Server Reporting Services SSRS non sanifica correttamente una richiesta web appositamente predisposta verso un server SSRS interessato...

CVE-2026-34975

CVE-2026-34975 — Iniezione di intestazioni email CRLF in Plunk tramite costruzione MIME grezza Gravità : Alta CVSS 8.5 CWE : CWE-93 — Neutralizzazione impropria delle sequenze CRLF 'Iniezione CRLF' Componente interessato : useplunk/plunk tutte le versioni precedenti alla correzione Advisory : GHS...

CVE-2026-39842

CVE-2026-39842: Iniezione di Espressioni in OpenRemote - RCE nel Rules Engine TL;DR Vulnerabilità critica di esecuzione remota di codice nel Rules Engine di OpenRemote che consente agli utenti autenticati con ruolo write:rules di eseguire codice arbitrario sul server con privilegi di root...

CVE-2026-1953

CVE-2026-1953 | XSS persistente — Nukegraphic CMS v3.1.2 Panoramica Una vulnerabilità di Cross-Site Scripting XSS persistente è presente in Nukegraphic CMS v3.1.2. Il problema consente a un utente autenticato di iniettare JavaScript dannoso nel campo nome del profilo , che viene salvato nel...

CVE-2026-30082

Vulnerabilidades de Cross-site Scripting XSS Armazenado no recurso de Edição da página de Lista de Pacotes de Software do IngEstate Server Versão afetada: IngEstate Server - 11.14.0 Função Afetada API afetada: API afetada: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC Para explorar esta...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 è una vulnerabilità di Cross-Site Scripting persistente Stored XSS che interessa Mautic 7 versioni dalla 7.0.0 alla 7.1.1. La falla risiede nel componente Projects, in cui i nomi dei progetti vengono visualizzati come tag e popover al passaggio del mouse sulle pagine...

CVE-2023-32749-PoC

CVE-2023-32749 | Atribuição de Função Não Autorizada no Pydio Cells Exploit para CVE-2023-32749 que afeta Pydio Cells 4.1.2 e anteriores. Um usuário autenticado com privilégios baixos pode criar um novo usuário externo com todas as funções atribuídas, concedendo acesso a todas as células e espaço...

CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down...