1115 matches found
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite I'm a simple man, I see cvss:10/10 I go in xD I saw this new CVE CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content...
CVE-2023-4771
CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771 PoC CKEditor 4 Cross-site scripting XSS vulnerability in AJAX sample This document describes how to perform an XSS vulnerability CVE-2023-4771 using CKEditor. Make sure the following is done with great caution to follow...
CVE-2023-46694
CVE-2023-46694 Descubierto por: Federico Zambito con Innovery Resumen Vtenext 21.02 permite a un atacante autenticado subir archivos arbitrarios, lo que resulta en la ejecución remota de código. Esta falla existe debido a que la aplicación no aplica controles de autenticación adecuados al acceder...
CVE-2024-37888
CVE-2024-37888 Este repositorio documenta los detalles de la vulnerabilidad y el exploit para CVE-2024-37888, descubierta y reportada por mí mismo. Metrics CWE-79: Neutralización incorrecta de la entrada durante la generación de páginas web 'Cross-site Scripting' CVSS: 6.1 MEDIO Vulnerability...
CVE-2018-15961
CVE-2018-15961 Unrestricted file upload in Adobe ColdFusion root@kitploit: POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36...
Drupal 7 CKEditor XSS
CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...
CVE-2024-24816
CVE-2024-24816 CKEditor 4 XSS This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts. Affected versions 4.24.0-lts Advisory Update CKEditor 4 to version 4.24.0-lts or newer...
CVE-2018-15961
CVE-2018-15961 - Adobe ColdFusion 2018 RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2018. Descripción del Exploit El exploit envía una solicitud POST que contiene una reverse shell JSP a...
CVE-2018-15961
CVE-2018-15961 - Adobe ColdFusion RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2021. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If successfull...
Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013)
According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.17, 11.3.x prior to 11.3.17, or 11.4.x prior to 11.4.7. It is, therefore, affected by a vulnerability. - The Drupal project uses the CKEditor library for WYSIWYG editing. CKEdit...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
EUVD-2026-74260
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741: Improper Neutralization of Input During Web Page Generation
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
PT-2026-88461
Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...
CVE-2026-78741
Silverpeas Core versions
Malicious code in @onereach/ckeditor5-build-classic (npm)
npm/@onereach/ckeditor5-build-classic is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
