CVE-2023-43878-RiteCMS-Stored-XSS---MainMenu

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Multiple Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a crafted payload i to the Main Menu - Items in the Administration Menu. Attack Vectors:...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

r00kie-kr00kie

r00kie-kr00kie Disclaimer This is a PoC exploit for the CVE-2019-15126 kr00k vulnerability. This project is intended for educational purposes only and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials...

CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

EUVD-2026-125089

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the editposts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages...

CVE-2026-127094

Pagelayer versions 2.1.7 before 2.2.1 are vulnerable to a missing authorization flaw within the Abilities API. The issue stems from abilities registered in main/abilitiesregister.php that only require the edit_posts capability. This allows contributor-level attackers to perform unauthorized actio...

CVE-2026-127094 Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the editposts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages...

PT-2026-146502

Name of the Vulnerable Software and Affected Versions Pagelayer versions 2.1.7 through 2.2.0 Description A missing authorization issue exists in the Abilities API within the main/abilitiesregister.php file. This flaw allows attackers with contributor-level permissions to bypass intended...

ifuncd-up

in response to Hacker News... I see you jokers on the orange websitehn are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested,...

CVE-2026-126642

An authorization flaw in AWX (Red Hat Ansible Automation Platform) allows a user to attach a webhook token credential —such as a GitLab token—that they do not have permission to use. The root cause is located in awx/main/access.py, where the JobTemplateAccess and WorkflowJobTemplateAccess classes...

CVE-2026-126642

An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential userole when assigning the single-valued webhookcredential foreign key:...

CVE-2026-118414

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...

CVE-2026-118414

Apache Roller versions 6.1.2 through 6.1.6 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from an HTML-stripping routine that fails to close a specific tag, combined with the main menu printing the weblog description without proper escaping. This allows a weblog admin...

EUVD-2026-123516

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...

CVE-2026-118414

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...

PT-2026-145184

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...

CVE-2026-118414: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was no...