public-pentesting-reports

公開ペネトレーションテストレポート コンサルティング企業や学術系セキュリティグループが公開したペネトレーションテストレポートをまとめたリポジトリです。 Blaze Information Security https://www.blazeinfosec.com の Julio が管理しています。 Arne Padmos 氏が 2015年に開始したリスト に基づいています。脅威モデリングの分野における同様の取り組みについては、このリポジトリ を参照してください。...

webui

Copyright C 2003-2021 Young Consulting, Inc このプログラムはフリーソフトウェアです。あなたはこれを、フリーソフトウェア財団によって発行された GNU 一般公衆利用許諾書（バージョン2、またはお望みならばそれ以降のバージョン）の条項に基づいて再頒布または改変することができます。 このプログラムは有用であることを期待して頒布されますが、いかなる保証もありません。商品性または特定目的への適合性に関する暗黙の保証も含め、一切の保証はありません。詳細については GNU 一般公衆利用許諾書を参照してください。 あなたはこのプログラムとともに GNU...

CVE-2026-30252

ZenShare Suite - 脆弱性開示 このリポジトリには、ZenShare Suite アプリケーションで発見された複数の Reflected Cross-Site Scripting XSS 脆弱性に関する詳細が含まれています。 脆弱性の概要 ZenShare Suite アプリケーションは、ログイン機能とパスワード回復機能に影響を及ぼす Reflected Cross-Site Scripting XSS に対して脆弱です。攻撃者は、悪意のある URL を作成し、被害者を騙してその URL にアクセスさせることで、被害者のブラウザ上で任意の JavaScript...

CVE-2026-14805

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...

EUVD-2026-78466

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...

CVE-2026-14805 Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...

CVE-2026-14805

The Consulting WordPress theme (Consulting – Business, Finance WordPress Theme) is affected by an authenticated privilege escalation in versions up to and including 6.7.16 . Two combined flaws enable the attack: the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/cla...

CVE-2026-14805 Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...

WordPress Consulting - Business, Finance WordPress Theme theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability

WordPress Consulting - Business, Finance WordPress Theme theme = 6.7.16 - Authenticated Subscriber+ Privilege Escalation vulnerability discovered by lhking in WordPress Theme Consulting versions = 6.7.16...

CVE-2026-14805: Improper Privilege Management

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key...

PT-2026-92016

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: 1 the masterstudy ms stm set discard transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient k...

CVE-2026-4773

The CVE-2026-4773 entry covers Magarsus Consulting Ltd. Co. IDM-MFA and describes an improper validation of input type that enables authentication bypass. Affected versions are IDM-MFA from 2025.11.27 up to (but not including) 2026.03.10. The NVD entry lists a CVSS v3.1 base score of 8.1 (High) w...

CVE-2026-4773

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

EUVD-2026-47654

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

CVE-2026-4773: Improper Validation of Specified Type of Input

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

PT-2026-63366

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...

PT-2026-57260

Name of the Vulnerable Software and Affected Versions SEM-PMP versions prior to 23042026 Description Improper neutralization of special elements used in an SQL command leads to a SQL injection flaw. This issue allows for Command Line Execution, which is the ability to run arbitrary operating syst...

CVE-2026-5005: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Twiser Informatics Technology Consulting, Trade and Education Inc. OKRs & Goals allows Stored XSS. This issue affects OKRs & Goals: from 28220 before 28398...

FBI Seizes China-Linked Fake Consulting Sites Targeting US Clearance Holders

The Justice Department and FBI seized 13 fake consulting websites that officials say targeted US clearance holders with paid research work designed to obtain sensitive government information...

EUVD-2026-30759

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS. This issue affects DernekWeb: through 30122025...