cent

社区版 Nuclei 模板，一个简单的工具，让你可以将社区提供的所有 Nuclei 模板集中在一个地方。 安装 root@kitploit: go install -v github.com/xm1k3/cent/v2@latest 或者 从 releases 下载 安装后运行 cent init，使用你可在此处找到的配置文件来初始化 cent。 支持的命令 根标志 root@kitploit: Flags: --config string config file default is .config/cent/.cent.yaml -r, --by-repo Group templat...

CVE-2023-44770_ZenarioCMS--Reflected-XSS---Organizer-Alias

ZenarioCMS 反射型XSS v.9.4.59197 作者：Sergio 描述： ZenarioCMS v.9.4.59197 中存在跨站脚本（XSS）漏洞，允许本地攻击者通过特制脚本向 Organizer - Spare alias 执行任意代码。 攻击向量： Spare alias 中对输入的净化处理存在脚本漏洞，允许注入 JavaScript 代码，当用户访问网页时将执行该代码。 POC: 登录面板后，我们将转到 Organizer 菜单中的“Organizer - Spare alias”。 我们点击“Create a spare alias”，然后在 Spare alia...

CVE-2015-10034

CVE-2015-10034 此仓库是为了演示 J-TAS Action 而创建的。 workout-organizer-2aaedb7f69ea398a0217493fefe8f19b31ee0775 文件夹包含与 CVE-2015-10034 相关的脆弱应用程序。 我们已包含 J-TAS Action 执行分析结果的 SARIF 文件。...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77145

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

EUVD-2026-65332

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77144

CVE-2026-77144 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2), specifically in its frontend management plugin. The plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own, while th...

CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

EUVD-2026-65331

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

CVE-2026-77145 Broken Access Control in extension "Events 2" (events2)

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

CVE-2026-77145

CVE-2026-77145 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2) . The root cause is a flawed permission check in the frontend management update flow: it verified a different event than the one the request actually modified. As a result, a user with frontend event...

CVE-2026-72546

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72546

Attendize CVE-2026-72546 is an insecure direct object reference in the postInviteAttendee endpoint, exploitable by any authenticated event organiser to inject attendees and orders into events owned by other accounts. The endpoint loads the target event by ID without scoping to the authenticated o...

PT-2026-70121

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72690

CVE-2026-72690 | Attendize : An improper authorization vulnerability allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer’s events via POST /event/{event_id}/question/create. The root cause is that postCreateEventQuestion loads the target ...

CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304

The CVE affects the WordPress plugin Plugin Organizer . The vulnerability exists in versions up to and including 10.2.4 due to insufficient escaping of the PO_plugin_path parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(...

EUVD-2026-49988

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...

CVE-2026-15304

The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...