news-8.6.0-cve-2026-8726-backport

georgringer/news 8.6.0 向けセキュリティバックポート このリポジトリには、TYPO3 拡張機能 georgringer/news における高深刻度の SQL インジェクション脆弱性である CVE-2026-8726 / TYPO3-EXT-SA-2026-010 に対する最小限のバックポートが含まれています。 これは、一時的に news 8.6.0 に留まらざるを得ないインストール環境のみを対象としています。サポートされている修正方法は、拡張機能をメンテナンスされているバージョンにアップグレードすることです。このパッチは、news 10.0.4...

burpsuite-copy-as-xmlhttprequest

XMLHttpRequest로 복사 BurpSuite 확장 프로그램 이 확장 프로그램은 BurpSuite에 컨텍스트 메뉴를 추가하여 여러 요청을 Javascript의 XMLHttpRequest로 복사할 수 있게 해주며, XSS를 악용할 때 PoC 개발을 간소화합니다. 설치 릴리스에서 최신 JAR을 다운로드하거나 수동으로 빌드합니다 다음 탭을 사용하여 BurpSuite에 JAR 추가: "Extender" - "Extensions" - "Add" 사용 방법 아무 탭에서 하나의 요청을 선택하거나 "Proxy" - "HTTP...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-11601

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601

The WPCafe WordPress plugin (versions up to and including 3.0.19 ) is vulnerable to an authorization bypass because it fails to verify user permissions for specific actions. Specifically, the Email_Automation_Service_Provider::is_enable() method unconditionally returns true, leaving endpoints act...

EUVD-2026-91955

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...

ContextMenuHijack

ContextMenuHijack この着想のきっかけは、@NinjaParanoid です： ContextMenuHijack は、人間の行動に基づく COM ハイジャッキングを利用したシンプルな永続化テクニックです。ファイルエクスプローラーでファイル/フォルダーを右クリックしてコンテキストメニューを開くと、指定したビーコンが同時に実行されます。 IFACEMETHODIMP FileContextMenuExt::Initialize LPCITEMIDLIST pidlFolder, LPDATAOBJECT pDataObj, HKEY hKeyProgID DWORD tid...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 작성자: Sergio 설명: WBCE CMS 1.6.1은 Intro Page 매개변수에 제작된 페이로드를 통해 공격자가 임의의 코드를 실행할 수 있게 하는 크로스사이트 저장형 스크립팅XSS 취약점의 영향을 받습니다. 페이로드는 사용자의 세션과 무관하게 메인 페이지에서 실행되므로, 다른 사용자로 홈페이지에 접근하더라도 페이로드가 실행됩니다. POC: 패널에 로그인하면 Pages의 "Modify Intro Page" 섹션으로 이동합니다...

telnet-CVE-2026-24061

https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnetrce.py コードを理解する必要がある 2. inputを使わず、直接zmienna = ''で動作するコードを構築する コードはあらゆるデバイスと互換性がなければならないため、os.system'polecenie'のようなコマンドは使用できない 3. simple-term-menuによるGUIの追加...

CVE-2024-38793-PoC

CVE-2024-38793-PoC CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 - 인증된 Contributor+ SQL 인젝션 악용을 위한 개념 증명PoC 코드입니다. 개념 증명 이 문서는 CVE-2024-38793 취약점에 대한 개념 증명PoC 익스플로잇입니다. 이는 1.4.2 미만 버전의 WordPress 플러그인 Best Restaurant Menu 일명 Great Restaurant Menu WP에서 발생하는 SQL 인젝션 취약점입니다. 이 취약점은...

CVE-2026-91832

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

EUVD-2026-89620

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-91832

The WP Mobile Menu WordPress plugin (versions before 2.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to correctly verify the nonce during the settings import process. An attacker can exploit this via a cross-site request during an administrator's session to ...

CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-22101

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

EUVD-2026-88972

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-22101

A sensitive information leak exists via an obfuscated service menu accessible with physical access . This vulnerability allows an attacker to view sensitive data, including serial numbers , MAC addresses , and WiFi network passwords . No specific software or hardware versions or remediation steps...