CVE-2022-42092

CVE-2022-42092 Exploit en Python 🔥 Descripción Este script de exploit en Python ataca una subida de archivos sin restricciones en Backdrop CMS para lograr una Ejecución Remota de Código RCE. ⚠️ Versiones Afectadas Versión 1.22.0 y versiones anteriores Nota: Backdrop CMS disputa esto y argumenta qu...

vulnx

VulnX Vulnx 🕷️ 是一个智能机器人自动Shell注入器，能够检测多种类型CMS的漏洞 https://github.com/anouarbensaad/vulnx/archive/master.zip VulnX 维基 • 如何使用 • 兼容性 • 库 • Vulnx 是一个智能机器人自动 Shell 注入器，能够检测多种类型 CMS 的漏洞，实现快速 CMS 检测、信息收集以及目标漏洞扫描，包括子域名、IP 地址、国家、组织、时区、区域、ANS 等信息。 与其他所有工具不同，VulnX 不会手动逐个注入 Shell，而是分析目标网站，检查是否存在漏洞，如果存在则自动注入...

CVE-2023-23752-Joomla

CVE-2023-23752-Joomla 免责声明： 本网络安全工具仅用于提供技术支持，不涉及任何应用或商业行为。用户在使用本网络安全工具的过程中，不得以任何方式损害他人的合法权益。 该工具的运行仅依赖用户提供的信息，并不包括任何违反相关法律法规的内容。用户在使用本网络安全工具时，必须确保其提供的信息合法、有效、真实可靠，否则可能会产生不利后果。 本软件提供的服务仅供参考，不构成任何责任。用户在使用本网络安全工具时，应自行承担有关安全风险。我们并不对使用者使用本工具所涉及的任何技术服务承担任何义务或责任，无论此类技术服务是否有任何损失和/或损害。 介绍： Joomla 未授权访问漏洞...

The vulnerability of the wp-login.php file within the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Incomplete List of Disallowed Inputs

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the create function in non-sandboxed template contexts. An attacker can access arbitrary files on the server filesystem by instantiating SplFileObject...

CVE-2026-15533

A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit...

PT-2026-55072

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user...

CVE-2026-11511

The CVE-2026-11511 affects Bolt CMS up to version 3.7.5, specifically a weakness in the file src/Storage/Field/Type/TextType.php within the HTML Attribute Handler. The issue enables remote HTML injection when an attacker manipulates the argument style. It is exploitable remotely and an exploit ha...

CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire...

CVE-2026-39390

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting cMap field in compInfosPost sanitizes input using striptags with an allowlist and regex-based removal of...

CVE-2026-7888

CVE-2026-7888 affects Concrete CMS versions below 9.5.2. The vulnerability arises from PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that do not enforce allowed_classes. An unauthenticated attacker could trigger arbitrary PHP object instantiatio...

USN-8209-2: Little CMS vulnerability

USN-8209-1 fixed vulnerabilities in Little CMS. This update contains the fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could use thi...

CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

PT-2026-42556

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1 Description An Insecure Direct Object Reference IDOR exists in the 'AddMessage' and 'UpdateMessage' conversation controllers. These controllers accept user-supplied file attachment IDs through the attachmen...

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap

A flaw was found in the OpenSSL CMS implementation RFC 3211 KEK Unwrap. This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption PWRI...

CVE-2026-46408

Vvveb CMS vulnerable before 1.0.8.3: the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership, enabling a logged-in attacker to reuse another user’s cart in their own checkout session. The fixed version is 1.0.8.3. Impact per s...

CVE-2026-41524

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive !! !!. Any JavaScript or HTML injected by an editor-ro...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PageRules::create process in the page rules component. An attacker can publish a page without the required status-change permission by creating it as a non-draft. This lets a user who is allowed to create...

CVE-2026-31955 Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality

Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery SSRF vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS...