CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: corrección incompleta para CVE-2026-21724 permite al rol Editor eliminar puntos de contacto protegidos Producto: Grafana Grafana Labs — hasta 13.2.0 Archivo: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Control de acceso inadecuado CVSS 3.1:...

CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105692

The open-source design and prototyping platform Penpot contains an IDOR vulnerability in its delete-share-link RPC before version 2.18.0 . The application fails to verify if a caller is the creator of a share-link or possesses administrator authority, checking only if the caller can edit the pare...

CVE-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105678

The Ghost Node.js content management system is vulnerable to an improper privilege management issue in versions 0.5.0 through 6.64.0 . Staff users holding the Editor or Super Editor roles can bypass permission restrictions to assign their own roles to users with Author or Contributor roles. This ...

CVE-2019-12836

CVE-2019-12836 应用 JEditor v3.0.5 - JIRA 的所见即所得编辑器 适用于 Jira 的简单而强大的富文本编辑器。可导入 HTML 邮件、粘贴富内容、创建模板并预填充字段。 产品供应商 Bobronix 供应商网站 http://bobronix.com/ CVE 参考 https://vulners.com/cve/CVE-2019-12836 受影响的产品代码库 JEditor - Jira 的所见即所得编辑器 - v3.0.5 受影响组件 JEditor v3.0.5 描述 Jira 使用的 Bobronix JEditor 编辑器（v3.0.6...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Investigación: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Análisis d...

CVE-2018-17254

CVE-2018-17254 漏洞标题：Joomla JCK Editor 6.4.4 - 'parent' SQL注入 Google Dork：inurl:/plugins/editors/jckeditor/plugins/jtreelink/ 供应商主页：http://docs.arkextensions.com/downloads/jck-editor 版本：6.4.4 测试环境：Debian 10 Ubuntu Windows 11/10 CVE编号：CVE-2018-17254 PHP版本（漏洞利用）：7.3.27...

Joomla_CVE_2026_48907

MASTA CVE-2026-48907 扫描器 单文件、自包含的扫描器，用于 Joomla! JCE Editor 作者：Alma !CAUTION 🚨 免责声明 — 使用前请阅读 这是一个侵入式安全测试工具。 本工具仅限授权安全评估使用。 扫描您不拥有或未经书面许可进行测试的系统，在大多数司法管辖区属于违法行为。 作者（Hussein Mohamed masta ghimau）对因使用本工具而产生的任何误用、损坏、法律诉讼或数据丢失绝对不承担任何责任。 运行此扫描器即表示您同意： 仅扫描您拥有或获得明确书面同意的资产。 理解作为侵入式准确性检查的一部分，会向目标服务器上传一个无害的...

CVE-2022-42095

Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Page. Vectores de ataque: El atacante debe publicar algo en el "contenido de la página" e insertar l...

CVE-2023-42426

CVE ID: CVE-2023-42426 Vulnerability Type: Cross-Site Scripting Description: Cross-site scripting XSS vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component. Steps to reproduce: 1. Select the...

dbeaver v26.2.2

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 Cross-Site Scripting XSS Reflejado ID CVE: CVE-2021-3030 Estado: Reservado por el Programa CVE MITRE el 2021-01-06. Nunca se ha publicado ningún registro público para este ID — este documento es la referencia pública necesaria para completar dicha publicación. Tipo...

CVE-2026-105220

A flaw was found in Twine. The application fails to properly sanitize markup during story import, allowing embedded malicious scripts to execute within the editor interface. By convincing a user to import a specially crafted story file, an attacker can leverage an internal inter-process...

CVE-2020-13654

CVE-2020-13654 - XWiki Platform 发现并报告者： Astaruf 完整分析文章： https://nstsec.com/en/posts/xwiki-xss-cve-2020-13654/ NVD 条目： https://nvd.nist.gov/vuln/detail/CVE-2020-13654 漏洞详情 XWiki Platform 12.8 之前版本 未对用户个人资料编辑器中的用户可控字段进行 HTML 编码。经研究确认受影响的字段为"公司"（位于 编辑 → 个人信息 下），但其他个人资料字段共享相同的代码路径。...

CVE-2025-66849

CVE-2025-66849 PoC de Escalada de Privilegios en Ghost CMS Resumen En Ghost Foundation Ghost CMS hasta la versión 6.4.0, el bloque HTML dentro del editor de borradores de publicaciones no sanitiza ni codifica correctamente el contenido proporcionado por el usuario, lo que resulta en una...

CVE-2018-7422

CVE-2018-12613 由于未对用户输入进行清理导致的本地文件包含漏洞。 受影响的软件 1. WordPress 插件：Site-Editor v.1.1.1； 使用方法 此 PowerShell 脚本需要两个参数来构造一个利用 HTTP 请求： 1. WordPress URL 端点 2. 要获取的远程服务器上的完整文件路径 示例 准备好所有参数以便使用该脚本： 然后文件就会被获取。 代码作者：@zc00l...

CVE-2018-7422

CVE-2018-7422 Exploit para CVE-2018-7422: Inclusión de archivos locales en el plugin Site Editor 1.1.1 de WordPress T1574.008 Sintaxis ruby Entorno de Laboratorio OffSec Proving Grounds - Readys Uso...

engagement-mgr

Engagement Manager Engagement Manager es una aplicación web para el seguimiento de compromisos de seguridad ofensiva. Cuenta con una interfaz de usuario moderna, construida con Next.js, Prisma y PostgreSQL. La aplicación incluye un calendario, compromisos, clientes, contactos, hallazgos y...

XPEViewer

Visor/editor de archivos PE para Windows, Linux y MacOS. Descarga: https://github.com/horsicq/XPEViewer/releases Cómo ejecutar: https://github.com/horsicq/XPEViewer/blob/master/docs/RUN.md Cómo compilar: https://github.com/horsicq/XPEViewer/blob/master/docs/BUILD.md Registro de cambios:...