CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Technical Overview This repository contains a Functional Proof of Concept PoC for a Mass Assignment vulnerability in Camaleon CMS versions prior to 2.8.1. The vulnerability resides in the updatedajax endpoint of the User Management module,...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership WordPress 플러그인 4.1.2 이전 버전에서는 Membership Addon이 활성화된 경우 사용자가 자신의 계정 역할을 설정하는 것을 막지 않아 권한 상승 문제가 발생하며, 인증되지 않은 사용자가 관리자 권한을 획득할 수 있습니다. 🔴 취약점 개요 CVE-2025-2563 — Membership Addon 역할 주입을 통한 인증되지 않은 권한 상승 설명: WordPress용 User Registration & Membership 플러그인 ...

CVE-2025-2304_POC

CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS Privilege Escalation This POC is used to exploit Camaleon CMS privileges to administrator. The exploit works by injecting role into the password reset function of an authenticated user. Prerequisites & Assumptions You have a user account on the...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Doctreat Core versions = 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers t...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - メンバーシップ登録による未認証の権限昇格 🔴 脆弱性の概要 CVE-2026-1492 — メンバーシップ登録による未認証の権限昇格 説明: WordPress 用の User Registration & Membership プラグインは、5.1.2 までの全バージョンにおいて、未認証の権限昇格 の影響を受けます。この脆弱性は、メンバーシップ登録処理中に、サーバーサイドの許可リストや権限チェックを実施せずに、ユーザーが指定したrole 値 を受け入れる...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - 認証済み（学生+）から管理者への特権昇格を引き起こす認可の欠落 🔴 脆弱性の概要 CVE-2026-4484 — 認証済み特権昇格（学生 → 管理者） 説明: WordPress用プラグイン Masteriyo LMS は、2.1.6 までの全バージョンにおいて 特権昇格 の脆弱性の影響を受けます。この脆弱性は InstructorsController::prepareobjectfordatabase 関数に起因し、REST APIリクエスト時にロール割り当てを適切に制限できません。学生レベルのアクセス権...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...

CVE-2026-1492

CVE-2026-1492 - WordPressユーザー登録プラグイン権限昇格エクスプロイト 説明 このリポジトリには、WordPressのUser Registration & Membershipプラグインに影響する重大な脆弱性であるCVE-2026-1492 の概念実証エクスプロイトが含まれています。 この脆弱性により、認証されていない攻撃者 がメンバーシップ登録プロセスを悪用して管理者アカウントを作成できます。 👉 この脆弱性の完全な技術分析はこちらで入手できます: 技術分析...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 1つの隠しフィールド。1つの値の改変。Webサイト全体への完全なアクセス。 🧨 攻撃者は何ができるのか? 攻撃能力| 影響 ---|--- 🔑 ログインなしで管理者アカウントを作成| サイト完全乗っ取り Full Site Takeover 📦 WooCommerceの顧客データにアクセス| データ漏洩 Data Breach 💉 プラグイン/テーマファイル PHP を編集| リモートコード実行 Remote Code Execution 🕳️ 隠しバックドアを作成| 永続的アクセス Persistent Access 👥...

CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Exploit for CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Pr...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

DEBIAN-CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

SSSD (System Security Services Daemon) LDAP sudo provider is vulnerable when ldap_sudo_search_base is not configured; SSSD will search the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object, granting root-level ...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474 Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

CVE-2026-14474

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...