CVE-2026-81652

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-14844

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

authz0

Authz0は自動認可テストツールです。URLとロール・認証情報に基づいて不正アクセスを特定できます。 URLとロールはYAMLベースのテンプレートで管理され、authz0を使用して自動的に作成・追加できます。また、一度作成・生成したテンプレートファイルを使って、複数の認証ヘッダーやCookieに基づいたテストも可能です。 🛸 主な機能...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87068

The Forminator Forms WordPress plugin prior to 1.57.2.1 contains an authenticated privilege escalation vulnerability. When a registration form is nested inside an imported quiz, the role validation enforced elsewhere is bypassed, allowing a user with quiz import capability to publish a publicly r...

EUVD-2026-83664

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

EUVD-2026-83660

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the...

nimbostratus

Nimbostratus Tools for fingerprinting and exploiting Amazon cloud infrastructures. These tools are a PoC which I developed for my "Pivoting in Amazon clouds" talk, developed using the great boto library for accessing Amazon's API. For more information visit the project page Feel free to report...

rbac

PHP-RBAC v2.x PHP-RBAC 是一个用于 PHP 的授权库。它以迄今最快的实现，为开发者提供 NIST Level 2 层次化基于角色的访问控制及更多功能。 当前稳定版本： PHP-RBAC v2.0 联系我们 主页：http://phprbac.net/ OWASP 项目页面：https://www.owasp.org/index.php/Phprbac PHP-RBAC 文档：http://phprbac.net/docscontents.php PHP-RBAC Wiki：https://github.com/OWASP/rbac/wiki PHP-RBAC...

CVE-2020-14321

CVE-2020-14321 Las inscripciones a cursos permitieron una escalada de privilegios desde el rol de profesor al rol de gestor hasta RCE Quizás alguien necesite un script de Python, por lo tanto, lo he escrito para explotarla. Cómo usar este PoC: How to use this PoC script Case 1. If you have vaid...

CVE-2025-2304-POC

CVE-2025-2304-POC CVE-2025-2304 の PoC — Camaleon CMS 2.9.0 におけるパスワード変更エンドポイントでのマスアサインメントによる権限昇格。 脆弱性 /admin/users/:id/updatedajax エンドポイントは、モデル更新に渡す前に role パラメータをフィルタリングしないため、認証されたユーザーであれば誰でも管理者に権限昇格できます。 使用方法 root@kitploit: python3 CVE-2025-2304-POC.py -u http://target.htb --username bob --passwo...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — 未认证权限提升（通过角色注入） 🔥 漏洞摘要 WordPress 插件 Doctreat Core 版本 = 1.6.8 存在一个未认证权限提升 漏洞。该严重缺陷允许未认证攻击者 直接通过插件的注册 AJAX 端点创建新的管理员 账户。 该漏洞源于 hooks/hooks.php 文件中的 doctreatprocessregistration 函数，该函数直接从用户提交的 POST 数据中接受 usertype 参数，并将其作为 role 参数传递给...

CVE-2024-23724

安装 自动安装（推荐） 为了测试该漏洞，我们需要两个账号：一个具有管理员（所有者）角色的账号，以及一个具有贡献者角色的账号。在 Ghost CMS 中，首先需要访问管理面板来创建所有者账号，然后从该账号邀请一位贡献者，让其创建自己的账号。然而，在 Ghost 中，邀请贡献者的唯一方式是通过电子邮件发送邀请链接，这需要一个邮件投递服务来将邮件发送到贡献者的账号。为了方便起见，我们创建了一个 Mailgun 账号，向 Ghost 添加了一个贡献者，然后在我们所处的状态下创建了一个数据库转储文件。在我们的 Docker Compose 配置中，我们确保在启动 Ghost...

Flowise < 3.0.1 - Remote Command Execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes テーマ = 4.4.0 - 権限昇格 🔥 脆弱性概要 WordPressテーマRealHomesのバージョン4.4.0以下には、権限昇格の脆弱性 が存在します。これにより、低い権限（購読者など）で認証されたユーザーが、管理者にロールを昇格させることが可能です。この脆弱性はinspiryupdateprofile関数で発生し、ereallowuserschangeroleオプションが有効な場合にユーザーがロールを変更することを不適切に許可します。...

ludus_xz_backdoor

Ansible 角色：xz 后门 CVE-2024-3094（用于 Ludus） 一个 Ansible 角色，用于在 Debian 主机上安装 xz 后门 CVE-2024-3094，并可选择安装 xzbot 工具。 !WARNING 此角色会故意部署恶意软件！ 如果不将主机暴露在互联网上，你 应该 是安全的，但它仍然是恶意软件。请小心。 要求 基于 Debian 的操作系统 角色变量 可用变量及其默认值如下（参见 defaults/main.yml）： root@kitploit: 安装用于向后门发送命令的 xzbot CLI 工具。它将安装到 /usr/bin/xzbot...