CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment 권한 상승 📌 프로젝트 설명 CVE-2025-2304 는 Camaleon CMS버전 2.9.1의 Mass Assignment 취약점으로, 인증된 사용자가 비밀번호 변경 요청에서 role 파라미터를 조작하여 관리자로 권한을 상승시킬 수 있습니다. 🚨 기술적 취약점 설명 취약점 배경 Camaleon CMS는 Ruby on Rails를 사용하며, 버전 2.9.0의 UsersControllerupdatedajax 컨트롤러에 Mass Assignment...

CVE-2025-6934

🚨 WordPress OpalEstate 플러그인 - 인증되지 않은 권한 상승 취약점 🔎 설명 WordPress용 OpalEstate 플러그인은 AJAX 등록 핸들러에 심각한 취약점을 포함하고 있어, 인증되지 않은 사용자가 관리자로 등록 할 수 있습니다. 문제는 admin-ajax.php를 통해 공개적으로 노출된 opalestateregisterform AJAX 액션에서 role 매개변수를 안전하지 않게 처리하는 데 있습니다. 유효한 nonce를 가진 공격자는 role=administrator 필드를 제출하기만 하면 권한을...

CVE-2026-5118

Divi Form Builder ⚠️ 경고: 이 도구는 공인된 침투 테스트 및 보안 연구용입니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다. 소유권이 있거나 명시적인 서면 허가를 받은 시스템에서만 사용하십시오. 추가 면책 조항: Jenderal92의 표지에서 면책 조항을 확인할 수 있습니다. 여기서 확인하세요 !!! 개요 이 Python 2 스크립트는 Divi WordPress 플러그인및 관련 Divi 양식의 권한 상승 취약점을 악용합니다. 다음 방법을 통해 원격으로 관리자 계정을 등록할 수 있습니다: 대상의 Divi 등록...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444

CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) WordPress plugin, affecting all versions up to and including 3.47.13 . The root cause is insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. Authenticate...

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-14444 WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS 플러그인 1.0.4.7 - 1.0.5.1 - 'createOrder'를 통한 인증되지 않은 권한 상승 ⚠️ CVE-2025-14156 – Fox LMS WordPress 인증되지 않은 권한 상승 익스플로잇 🛡️ 취약점 개요 Fox LMS – WordPress LMS 플러그인 v1.0.4.7 v1.0.5.1 –createOrder를 통한 인증되지 않은 권한 상승 Fox LMS for WordPress의 1.0.5.1 을 포함한 모든 버전에서 권한 상승 취약점이...

CVE-2025-2304-POC

CVE-2025-2304-POC CVE-2025-2304에 대한 PoC — Camaleon CMS 2.9.0의 비밀번호 변경 엔드포인트에서 매스 어사인먼트mass assignment를 통한 권한 상승 취약점. 취약점 /admin/users/:id/updatedajax 엔드포인트는 모델 업데이트에 전달하기 전에 role 파라미터를 필터링하지 않으므로, 인증된 사용자라면 누구나 관리자로 권한을 상승시킬 수 있습니다. 사용법 root@kitploit: python3 CVE-2025-2304-POC.py -u...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

EUVD-2026-68880

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-75460

XueZhiSi Open Source Exam System versions 3.9.0 and below contain a privilege escalation vulnerability in the teacher-end interface at POST /api/teacher/user/page/list . The root cause is that the role parameter in UserPageRequestVM is fully controllable by the requester, allowing a low-privilege...

CVE-2026-15369 Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

CVE-2026-36102

Bluewave Labs Checkmate versions up to and including 3.3.0 are affected by a privilege escalation vulnerability in the inviteController.js component. A remote authenticated administrator can exploit the role parameter at the /api/v1/invite endpoint to escalate their privileges to superadmin . The...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...