50 matches found
CVE-2025-2304-CamaleonCMS-PoC
PoC: CVE-2025-2304 - Camaleon CMS Privilege Escalation Technical Overview This repository contains a Functional Proof of Concept PoC for a Mass Assignment vulnerability in Camaleon CMS versions prior to 2.8.1. The vulnerability resides in the updatedajax endpoint of the User Management module,...
CVE-2025-2563
CVE-2025-2563 The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges 🔴 Vulnerability Overview...
CVE-2025-2304_POC
CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS Privilege Escalation This POC is used to exploit Camaleon CMS privileges to administrator. The exploit works by injecting role into the password reset function of an authenticated user. Prerequisites & Assumptions You have a user account on the...
CVE-2025-6254
CVE-2025-6254 — Doctreat Core = 1.6.8 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Doctreat Core versions = 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers t...
CVE-2026-1492
CVE-2026-1492 - WordPress User Registration Plugin Privilege Escalation Exploit Description This repository contains a proof-of-concept exploit for CVE-2026-1492 , a critical vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated...
CVE-2026-4484
CVE-2026-4484 Masteriyo LMS = 2.1.6 - Missing Authorization to Authenticated Student+ Privilege Escalation to Administrator 🔴 Vulnerability Overview CVE-2026-4484 — Authenticated Privilege Escalation Student → Administrator Field| Details ---|--- CVE ID| CVE-2026-4484 Severity| HIGH — CVSS v3.1...
CVE-2026-1492
CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 🔴 Vulnerability Overview CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration Field| Details ---|--- CVE ID| CVE-2026-1492 Severity| CRITICAL — CVSS...
CVE-2025-14736
CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...
CVE-2026-5118
CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...
CVE-2026-70411
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
EUVD-2026-93461
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-70411
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-70411
Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability within the csm-authorization-tenant gRPC service (TenantService) . An unauthenticated attacker positioned on an adjacent network could exploit this flaw to ...
CVE-2026-5118
CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...
PT-2026-106773
Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM versions prior to 1.18.0 Description The csm-authorization-tenant gRPC service TenantService lacks authentication for critical functions. An unauthenticated adjacent network attacker could exploit this to...
CVE-2026-70411: Missing Authentication for Critical Function
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-5118
🔥 CVE-2026-5118 Divi Form Builder One hidden field. One changed value. Full access to the entire website. 🧨 What an Attacker Can Do? Capability| Impact ---|--- 🔑 Create admin account without login| Full Site Takeover 📦 Access WooCommerce customer data| Data Breach 💉 Edit plugin/theme files PHP|...
CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
