28670 matches found
CVE-2024-2782-PoC
CVE-2024-2782-PoC CVE-2024-2782 Доказательство концепции Плагин Contact Form от Fluent Forms для Quiz, Survey, и Drag & Drop WP Form Builder для WordPress уязвим к несанкционированному изменению данных из-за отсутствия проверки прав доступа на конечной точке REST API...
Packages_app_settings_CVE-2020-0201
이 저장소에는 README가 없습니다...
TP-L-NK-SIZMA-EXPLO-T
TP-LiNK-SIZMA-EXPLOiT TP-Link Router Authenticated RCE Exploit CVE-2022-30075 Bu araç, TP-Link Archer AX50 ve bazı diğer TP-Link router modellerinde bulunan CVE-2022-30075 güvenlik açığını kullanarak kimliği doğrulanmış uzaktan komut çalıştırma Authenticated Remote Code Execution işlemi...
CVE-2025-10377
Доказательство концепции CVE-2025-10377 Межсайтовая подделка запросов CSRF в плагине System Dashboard Функция sdtogglelogs Тип уязвимости: Межсайтовая подделка запросов CSRF Затронутая функция: sdtogglelogs CVSS v3.1: 4.3 Средний Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Примечание: Оценка...
CVE-2026-104119
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...
CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...
EUVD-2026-92073
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...
EUVD-2026-92071
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...
packages_apps_Settings_AOSP_10_r33_CVE-2022-20360
В этом репозитории нет README...
MDE-AuditCheck
MDE-AuditCheck Проверяет, что все параметры аудита, на которые полагается MDE, правильно настроены в GPO Скрипт зависит от средств удалённого администрирования сервера RSAT...
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
PT-2026-104606
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...
CVE-2026-104119: Undefined Security Weakness
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...
CVE-2026-105129: Incorrect Authorization
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129
LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...
CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability
Settings Change vulnerability discovered by Mor Golan in WordPress Plugin 워드프레스 결제 심플페이 versions = 5.5.17...
CVE-2023-6289
CVE-2023-6289 Swift Performance Lite = 2.3.6.14 — Отсутствие авторизации при экспорте настроек для неавторизованных пользователей Описание Плагин Swift Performance Lite для WordPress уязвим к несанкционированному доступу к данным из-за отсутствия проверки возможностей в функциональности,...
CSZ-CMS-Stored-XSS---Site-Settings
CSZ CMS: хранимая XSS v1.3.0 Автор: Sergio Описание: Уязвимость межсайтового скриптинга XSS в CSZCMS v.1.3.0 позволяет локальному злоумышленнику выполнить произвольный код с помощью вредоносного скрипта через параметр Additional Meta Tag в меню Site Settings. Векторы атаки: Внедрение скриптов...