CVE

Control Tower Notification Enabler 此 CDK 包安装了一个 Lambda 函数，并关联了一个 IAM 角色，同时将该 Lambda 函数订阅到 Control Tower 聚合安全通知。当发生 Control Tower 规则违规（例如 S3 存储桶公开可访问）时，Lambda 会向 Webhook 发送通知。 前提条件 组织的管理员访问权限。用于在审计账户中扮演 Control Tower 角色。 已安装 AWS CDK 已安装 AWS CLI 第二版 MacOS / Linux 在 macOS 或 Linux 上启用通知时，请以管理员用户身份运行...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

MOODLE-3.X-Remote-Code-Execution

MOODLE-3.X-Remote-Code-Execution cve-2018-1133 ejecución remota de código en Moodle autenticado como profesor...

CVE-2026-75927

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

EUVD-2026-74758

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-75927

CVE-2026-75927 affects the PublishPress Capabilities WordPress plugin (all versions ≤ 2.50.0 ). The root cause is the addPluginCapabilities() function, which unconditionally grants the Editor role all 15 manage_capabilities_* capabilities via a hard-coded $eligible_roles assignment that executes ...

CVE-2026-83541

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15690

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

EUVD-2026-74713

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2025-210873

The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...

AA Discord Audit

aa-discord-audit Reconciliation audit for Alliance Auth's Discord integration. Compares the actual role assignments in the configured Discord guild against the state expressed in Alliance Auth Groups + State per user and closes the gap through which moderators can hand-assign AA-named roles to...

polkit_CVE-2021-4034

Role Name Ansible role to patch RHSB-2022-001 Polkit Privilege Escalation - CVE-2021-4034 Requirements Repositories should be configured. Role Variables All the variables are in /vars/main.yml file. A list of polkit vulnerable packages is also added to the file as a list, you can update the list...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - 未认证权限提升 免责声明！ 本文档中提供的 CVE（通用漏洞与暴露）信息仅用于教育和参考目的。所提供细节基于作者对公开资源的检索、研究及分析。内容无意促进或鼓励任何非法活动，包括黑客攻击、漏洞利用或对系统的未授权访问。 作者对信息的任何滥用不承担任何责任。建议个人和组织负责任地应用这些知识，并遵守适用法律法规。强烈建议读者仅在获得适当授权的受控环境中测试漏洞。 本文档的作者和贡献者不支持或纵容恶意活动，并鼓励负责任的披露和道德黑客实践。 描述 在“User Registratio...

cve-2023-1874

CVE-2023-1874 免责声明 此脚本仅设计用于白帽子和教育目的。任何将此脚本用于未经授权测试或不属于您的设备的行为，均由您自行承担责任。此脚本作者对您使用此脚本所做的任何事情不承担任何责任。您的行为由您自己负责。 描述 CVE-2023-1874 是 WP Data Access 插件 5.3.7 及更早版本中的一个漏洞。攻击者可以在更新个人资料时提供 wpdarole 选项来提升权限。 来自 NIST： root@kitploit: The WP Data Access plugin for WordPress is vulnerable to privilege...

bash-fix-exploit

bash-fix-exploit 一个用于检查CVE-2014-6271漏洞是否仍然有效的小角色 使用风险自负... 在这里了解该漏洞：https://community.rapid7.com/community/infosec/blog/2014/09/25/bash-ing-into-your-network-investigating-cve-2014-6271 要求 假设你正在使用bash作为shell 角色变量 updatebash - 默认为 "no"。如果设置为 "yes"，则会在基于RedHat的系统上更新bash 依赖 无 示例剧本 root@kitploit: -...

CVE-2026-61910

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

EUVD-2026-75130

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

ALSA-2026:66248 Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...