CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Prueba de concepto Un exploit de prueba de concepto PoC para CVE-2018-16763 Fuel CMS - Ejecución remota de código sin autenticación previa. Descripción Este programa en Python 3 sirve como PoC para la vulnerabilidad CVE-2018-16763 en el sistema de gestión de contenidos Fuel CMS...

CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration ISR, response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a...

CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request t...

CVE-2026-94543

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543

The Next.js framework (versions 15.0.0 through 15.5.27 and 16.3.8 ) is vulnerable to cache poisoning in self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. The root cause is that response cache entries are not sufficiently boun...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91460

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...

EUVD-2026-91455

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104438 YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

CVE-2026-13413

The CMP – Coming Soon & Maintenance WordPress plugin, in versions prior to 4.1.20 , contains an Improper Access Control (CWE-284) vulnerability. When maintenance or coming-soon mode is active, unauthenticated visitors can bypass the landing page to access hidden site content, including published ...

PT-2026-104379

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions 16.x through 16.3.7 Description Self-hosted applications using the Pages Router with statically generated pages or Incremental Static Regeneration ISR can key a response cache entry...

PT-2026-104254

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-94543: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

Linux Distros Unpatched Vulnerability : CVE-2026-94543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router wit...