CVE-2026-30082

Vulnerabilidades de Cross-site Scripting XSS Almacenado en la función Editar de la página Lista de Paquetes de Software de IngEstate Server Versión afectada: IngEstate Server - 11.14.0 Función afectada API afectada: API afectada: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1 PoC Para explotar...

CVE-2025-46204

Descrição Unifiedtransform v2.0 é vulnerável a Controle de Acesso Incorreto. Qualquer usuário alunos e professores pode acessar e modificar detalhes de cursos através dos endpoints /course/edit/id. Esta funcionalidade é destinada exclusivamente para uso administrativo. Explorar esta falha permite...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- سجّل الدخول كمسؤول 2- افتح صفحة تعديل أي وحدة 3- افحص العنصر لأي زر اختيار radiobox بقيمة true 4- غيّر true إلى true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- انقر على زر التحديث 6- لتشغيل الأمر، عد إلى صفحة التعديل مرة أخرى CVE-2021-3291...

CVE-2025-22710

CVE-2025-22710 1️⃣ Тип компонента Плагин WordPress 2️⃣ Сведения о компоненте Имя компонента WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager Уязвимая версия = 8.50.0 Слаг компонента smart-manager-for-wp-e-commerce Ссылка на компонент...

CVE-2021-38603

CVE-2021-38603 Una vulnerabilità di cross site scripting persistente è presente nella pagina di modifica del Profilo nel campo Information: per ogni utente. http:///core/admin/profil.php Campi vulnerabili: Information: Una volta inserito, l'XSS può essere attivato visitando qualsiasi...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse è un'applicazione .NET scritta in C che può essere utilizzata per sfruttare i diritti di modifica di un utente su un Oggetto Criterio di Gruppo GPO al fine di compromettere gli oggetti controllati da tale GPO. Maggiori dettagli sono disponibili nel seguente post del...

CVE-2025-29602

CVE-2025-29602 - Gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke in FlatPress CMS 1.3.1 Beschreibung Eine gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke existiert im Administrationsbereich von Flatpress CMS 1.3.1. Ein Angreifer mit Admin-Rechten kann eine bösartige...

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

WordPress < 4.8.2 - Authenticated Open Redirect

WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

CVE-2026-18985

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-18985 Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-18985

CVE-2026-18985 is an Incorrect Authorization vulnerability in the Drupal Edit in-place field contrib module (versions 0.0.0 through 2.1.1 ). The module fails to sufficiently verify access rights when editing entities, allowing a malicious user to craft requests and modify any field on any entity ...

CVE-2023-48084-Revised

CVE-2023-48084 — PoC aggiornato Repository: MettHK/CVE-2023-48084-Revised Versione aggiornata di Hamibubu/CVE-2023-48084 con multithreading, estrazione tramite ricerca binaria e flag CLI per la selezione di database / tabella / colonna. Non è il repository originale. Si tratta di un PoC...

CVE-2026-77133

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77133

CVE-2026-77133 is a broken access control vulnerability in the TYPO3 extension femanager . When the profile edit plugin uses its default field configuration, it fails to restrict which frontend usergroups a logged-in user may assign to their own account, enabling self-service privilege escalation...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

EUVD-2026-65336

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...