CVE-2026-70376

CVE-2026-70376 — CSRF en todo el sitio de Pluck CMS → RCE Comprobación de Referer fail-open + sin tokens CSRF + subida de doble extensión Una sola visita de un administrador a una página elimina contenido, inyecta páginas y suelta un webshell...

CVE-2026-61457

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

WordPress plugin Download Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue exists in WordPress plugin...

EggBlog 4.1.1 - Local Directory Traversal

!/usr/bin/perl eggBlog agent'Lynx textmode'; $lib-timeout5; $response = $lib-get"http://$domain/lib/openwysiwyg/addons/imagelibrary/selectimage.php?dir=$param"; @director = $response-content = /.+?/ig; for my $i=0;$i=scalar@director;$i++ print $director$i."\n";...