PT-2026-104621

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql...

CVE-2025-34157

Coolify 删除流程中的存储型 XSS（CVE-2025-34157） 受影响版本： Coolify ≤ v4.0.0-beta.420.6 修复版本： v4.0.0-beta.420.7 严重性： 严重（9.4） CVSS 4.0 向量： CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE： CWE-79（跨站脚本），CWE-20（输入验证不当） 摘要 项目删除流程中的存储型 XSS 允许攻击者在管理员尝试删除由低权限用户创建的项目时，在管理员的浏览器中执行攻击者控制的 JavaScript。这可能...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

cve-2026-75157-poc

CVE-2026-75157 PoC Apache Airflow 3.3.2 より前のバージョンにおける queued-events 認可の脆弱性に関する、許可されたセキュリティ研究用 PoC。 スコープ 自身が所有する、または明示的にテストを許可された Airflow インスタンスに対してのみ実行すること。デフォルトのランナーは非ループバックのターゲットを拒否する。このリポジトリには、スキャン、ターゲット列挙、永続化、認証情報の窃取、破壊的なペイロードロジックは含まれていない。 ファイル README.md poc.py poc.py は、ターゲットを認識する汎用的な HTTP...

EUVD-2026-92016

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112 Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

CVE-2026-92437

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-91945

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 2.1.6 . The root cause is a lack of validation on a user-controlled 'id' parameter during deletion requests. This allows authenti...

EUVD-2026-91917

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-91854

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

PT-2026-104582

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An improper authorization issue exists where delegated administrators can destroy sessions outside their assigned realms. This occurs because realm checks are performed using the requester's realm...

PT-2026-104531

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 Description An issue exists where the plugin fails to require authentication, a nonce a unique token used to prevent replay attacks, or an ownership check before processing actio...

RazerEoP

RazerEoP Razer Synapse 3 Macroモジュールにおける任意のファイル削除/移動のPoCです。 このモジュールを使用すると、ユーザーは作成したマクロをディスク上のファイルにエクスポートでき、ファイル操作はnt authority\systemとして実行されるRazerサービスを介して行われます。 この問題をRazerのバグバウンティプログラムを通じて報告しようとしましたが、これはバグではなくエクスプロイトであるという返答を受け取りました 🤣。 その後、HackerOneにも報告しましたが、報告が古いことを理由にInformativeとしてクローズされました。...