112432 matches found
CVE-2024-4898-Poc
CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...
CVE-2021-3156
This repository does not have a README...
CVE-2024-5326-Poc
CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Falta de autorización para actualización de opciones arbitrarias Descripción El plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX para WordPress es vulnerable a la modificación no...
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...
CVE-2026-48907
CVE-2026-48907 PoC Educativo ⚠️ Este repositorio es solo con fines educativos y de seguridad defensiva. Pruebe únicamente en sistemas que le pertenezcan o para los que tenga autorización explícita. No utilice este proyecto contra sistemas de terceros. Este PoC demuestra la CVE-2026-48907, una...
Broken-Vulnerable-Code-Snippets
Vulnerable-Code-Snippets A collection of vulnerable code snippets taken form around the internet. Snippets taken from various blog posts, books, resources etc. No Copyright Infringement Intended Note: This is not a good benchmark for testing static analysis tools, they are broken code snippets,...
CVE-2026-31635
🩸 CVE-2026-31635 – DirtyDecrypt Escalada de Privilegios Local del Kernel de Linux mediante Corrupción de Caché de Página RXGK "DirtyDecrypt" — Parte de la familia de exploits "Dirty" de 2026 📖 Resumen DirtyDecrypt CVE-2026-31635 es una vulnerabilidad de escalada de privilegios local en el...
CVE-2022-22965-Spring4Shell
This repository does not have a README...
CVE-2026-56423-MISP-deleteSelection-BrokenAccessControl
CVE-2026-56423 — MISP deleteSelection Control de Acceso Roto Prueba de concepto de una vulnerabilidad de autorización faltante en los flujos de eliminación masiva de MISP para Event Reports y Sharing Groups. Los controladores deleteSelection autorizan cada elemento seleccionado con un callback qu...
CVE-2026-103337
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-105695
The open-source design and prototyping platform Penpot contains a missing authorization vulnerability in its chunked-upload assembly functionality. Prior to version 2.18.0 , the assemble-chunks function retrieves an upload session using only its session ID, failing to scope the lookup to the auth...
CVE-2026-105695 Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed...
CVE-2026-51947-Advisory
This repository does not have a README...
CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...
CVE-2022-3992
CVE-2022-3992 Cross-Site Scripting en WonderCMS Descripción: Una vulnerabilidad de cross-site scripting XSS en Sanitization Management System v1.0 permite a posibles atacantes subir archivos arbitrarios mediante un nombre manipulado en los campos del logotipo del sistema de los campos de...
CVE-2024-7135
CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...