CVE-2025-4796

CVE-2025-4796 eventin e atualizar o e-mail do palestrante para um e-mail que eles controlam. Então o atacante pode usar a redefinição de senha do WordPress para assumir a conta do administrador. requisitos: python 3.8 ou superior requests instalar requests: pip install requests uso execute o scri...

EUVD-2026-65275

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

CVE-2026-19892

The InfusedWoo Pro WordPress plugin (all versions up to 5.1.17 ) is vulnerable to Privilege Escalation via Account Takeover due to a missing capability check in the ajax_iwar_preview_email() function, which relies solely on is_admin() for authorization. An authenticated attacker with subscriber-l...

EUVD-2026-65274

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-19892 InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

CVE-2024-10557

Betroffene Version: BloodBank Management System : 1.0 Informationen zur Schwachstelle: Schwachstellentyp: Cross Site Request Forgery CSRF Schweregrad: HOCH Status: Nicht gepatcht Verwundbarer Endpunkt: Pfad: /file/updateprofile.php Beschreibung der Schwachstelle: Am Endpunkt /file/updateprofile.p...

nepstech-xpon-router-CVE-2024-40119

nepstech-xpon-router-CVE-2024-40119 Autor: Subhodeep Baroi CVE-2024-40119: Vulnerabilidade CSRF no Roteador Wi-Fi Nepstech NTPL-XPON1GFEVN v1.0 Descrição CVE-2024-40119 é uma vulnerabilidade de Cross-Site Request Forgery CSRF no roteador Wi-Fi Nepstech xpon NTPL-XPON1GFEVN v1.0, firmware v2.0.1...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

CVE-2022-37017

CVE-2022-37017 Authentifizierungsumgehung für das Benutzeroberflächen-Passwort von Symantec Endpoint Protection 14.3.5351 Client Symantec Endpoint Protection ermöglicht das Einrichten eines Passwortschutzes für die Benutzeroberfläche, um Konfigurationsänderungen zu verhindern. Diese Passwortprüfu...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMS Fehlerhafte Zugriffskontrolle → Account-Übernahme Fehlende Autorisierung bei den Admin-Server-Verwaltungsrouten in Azuriom CMS 1.2.11 ermöglicht es jedem Administrator mit niedrigen Privilegien der nur admin.access besitzt, ein AzLink-Server-Token zu erstellen und jed...

PT-2026-81497

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.2 Description An unauthenticated attacker can retrieve a plaintext password-reset URL via the trp get translations regular AJAX endpoint, enabling the takeover of any administrator account. This issue affec...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

VulnCheck KEV: CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket Dispatch-Header-Injection Lauffähiger Proof-of-Concept-Reproducer für die Apache-Camel-Schwachstelle, bei der der camel-atmosphere-websocket-Producer seine WebSocket-Empfänger aus websocket.-Exchange-Headern auswählt, deren Namen außerhalb des...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

CVE-2026-31309

CVE-2026-31309: Controllo di accesso improprio in Mysterium Node prima della v1.36.0 Un'autorizzazione impropria nell'endpoint /tequilapi/config/user di Mysterium Node dalla v1.21.1-rc0 fino alla v1.36.0 consente a un attaccante non autenticato di sovrascrivere arbitrariamente la configurazione d...

CVE-2025-65676

CVE-2025-65676 Vulnerabilità di Stored Cross-Site Scripting XSS in Classroomio LMS 0.1.13 consente ad attaccanti autenticati di eseguire codice arbitrario tramite immagini di copertina SVG appositamente create. Scoperta da - Rivek Raj Tamang RivuDon, Sikkim, India. Prodotto interessato: Classroom...

CVE-2026-71504

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover

CVE-2025-59382: QNAP पासवर्ड रीसेट से खाता अधिग्रहण अप्रमाणित हमलावर-नियंत्रित पासवर्ड रीसेट URL /cgi-bin/resetpassword.cgi में है। प्रयोगशाला में QuTScloud c5.2.4.3041 build 20250211 के विरुद्ध परीक्षण किया गया। QNAP ने बाद में इसे सलाह QSA-26-10 में CVE-2025-59382 के रूप में प्रकाशित किया।...

CVE-2026-71504 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...