CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user

CMSmadesimple Reflected XSS v2.2.18 Author: Sergio Description: Multiple cross-site scripting XSS vulnerabilites in install/adduser.php of CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again in the My Preferences - Add...

CVE-2024-39304

설명 이 스크립트는 ChurchCRM 프로젝트에서 입력값 정화sanitization가 이루어지지 않아 SQLi가 가능한 CVE-2024-39304에 대한 PoC입니다. 사용법 python3 CVE-2024-39304.py -u -p -b -v 예시: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v 링크...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Webmin-1.580---file-show.cgi-Manual-Remote-Command-Execution-Non-Metasploit-

Markdown Webmin 1.580 RCE Execution Guide Quick reference for executing authenticated Remote Code Execution RCE on Webmin 1.580 via the /file/show.cgi component. 1. Attack Machine Listener Run this command on your local machine to catch the incoming connection before executing the payload:...

CVE-2025-63821

CVE-2025-63821 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 4.8 Medium Vector:...

pgAdminOpendoor

pgAdminOpendoor CVE-2025-2945 Overview This is my research on CVE-2025-2945. This repo includes a test stand with postgress and vulnerable pgadmin, and exploit. CVE Usefull links: NVD Details WIZ Analyze Metasploit Breakdown In pgAdmin backend, which is written in python, there are two endpoint...

CVE-2020-8825

CVE-2020-8825 Pubblicazione: CVE-2020-8825 Fornitore: root@kitploit: PHP VanillaForum Descrizione: root@kitploit: La vulnerabilità esiste a causa di una sanitizzazione insufficiente dei dati forniti dall'utente passati all'URL "index.php?p=/dashboard/settings/branding". Un attaccante remoto può...

CVE-2024-33231

Ferozo Webmail XSS-Schwachstelle durch Datei-Upload CVE-2024-33231 Beschreibung Ferozo Webmail Version 1.1 ist anfällig für Cross-Site Scripting XSS über die Datei-Upload-Funktion. Ein Angreifer kann diese Schwachstelle ausnutzen, indem er eine speziell präparierte Datei mit schädlichem...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL-Injection, die zu Remote Code Execution RCE und Datei-Lesen führt Exploit-Tool für CVE-2024-9264, eine kritische Schwachstelle in Grafana , die es authentifizierten Angreifern ermöglicht, SQL-Abfragen auszuführen, was zu RCE führt 🛡️ Dieses Tool ist ausschließlich für...

CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

EUVD-2026-67409

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-22849

CVE-2026-22849: Saleor verfügt nicht über eine ordnungsgemäße HTML-Bereinigung für Rich-Text-Felder Übersicht...

PT-2026-82739

Name of the Vulnerable Software and Affected Versions MongoDB client library for PHP affected versions not specified Description The MongoDB client library for PHP fails to properly sanitize special elements within application-supplied namespace identifiers used to construct target namespaces for...

CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constru...

CVE-2025-56807

CVE-2025-56807 Descrizione Una vulnerabilità di Stored Cross Site Scripting XSS è stata scoperta in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 nella funzionalità File Manager. La vulnerabilità risiede nel parametro title inviato durante la creazione di nuove cartelle. A causa di una...

CVE-2026-18547

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-59296

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

CVE-2025-57389

CVE-2025-57389 - XSS منعكسة في OpenWRT 18.06.2 الوصف تم تحديد ثغرة أمنية من نوع XSS البرمجة النصية عبر المواقع المنعكسة في الإصدار EOL Luci OpenWRT v18.06.2 على نقطة النهاية /cgi-bin/luci/admin/system/packages. إثبات المفهوم 1. أثناء تمرير حركة المرور عبر Burp، انتقل إلى...