CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS 批量赋值权限提升 📌 项目描述 CVE-2025-2304 是 Camaleon CMS（版本 2.9.1）中的一个批量赋值（Mass Assignment）漏洞，允许已认证用户通过操纵密码更改请求中的 role 参数，将其权限提升为管理员。 🚨 技术漏洞解释 漏洞背景 Camaleon CMS 使用 Ruby on Rails，在 2.9.0 版本中，UsersControllerupdatedajax 控制器存在批量赋值 漏洞。该控制器使用了无限制的 .permit!，允许请求中发送的任何参数直接赋值给用户模型。 攻击向量 1...

CVE-2025-6934

🚨 WordPress OpalEstate 插件 - 未认证权限提升漏洞 🔎 描述 WordPress 的 OpalEstate 插件在其 AJAX 注册处理程序中存在一个严重漏洞，允许未认证用户注册为管理员 。 问题在于 opalestateregisterform AJAX 动作中对 role 参数的不安全处理，该动作通过 admin-ajax.php 公开暴露。攻击者只需提交有效的 nonce 和 role=administrator 字段即可提升权限，导致网站完全沦陷。 CVE ID: CVE-2025-6934 CVSS Score: 9.8 Critical 发布日期：20...

CVE-2026-5118

Divi Form Builder ⚠️ ADVERTENCIA: Esta herramienta es solo para pruebas de penetración autorizadas e investigación de seguridad. El acceso no autorizado a sistemas informáticos es ilegal. Úsela solo en sistemas que posea o para los que tenga permiso explícito por escrito para realizar pruebas. Más...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444

CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) WordPress plugin, affecting all versions up to and including 3.47.13 . The root cause is insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. Authenticate...

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS 插件 1.0.4.7 - 1.0.5.1 – 通过 'createOrder' 实现未认证权限提升 ⚠️ CVE-2025-14156 – Fox LMS WordPress 未认证权限提升利用工具 🛡️ 漏洞概述 Fox LMS – WordPress LMS 插件（v1.0.4.7 至 v1.0.5.1）– 通过createOrder 实现未认证权限提升 所有版本直到并包括 1.0.5.1 的 Fox LMS for WordPress...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC para CVE-2025-2304 — escalada de privilegios en Camaleon CMS 2.9.0 mediante asignación masiva en el endpoint de cambio de contraseña. Vulnerabilidad El endpoint /admin/users/:id/updatedajax no filtra el parámetro role antes de pasarlo a la actualización del modelo, lo que...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

EUVD-2026-68880

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-75460

XueZhiSi Open Source Exam System versions 3.9.0 and below contain a privilege escalation vulnerability in the teacher-end interface at POST /api/teacher/user/page/list . The root cause is that the role parameter in UserPageRequestVM is fully controllable by the requester, allowing a low-privilege...

CVE-2026-15369 Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

Bluewave Labs Checkmate versions up to and including 3.3.0 are affected by a privilege escalation vulnerability in the inviteController.js component. A remote authenticated administrator can exploit the role parameter at the /api/v1/invite endpoint to escalate their privileges to superadmin . The...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...