4 matches found
Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-
Nexus — 本地权限提升 PoC 通过伪造 Git 对象实现 Gitea 模板同步路径遍历 → root 针对 HackTheBox 机器 Nexus 的概念验证权限提升漏洞利用。 一个由 root 拥有的 systemd 服务将 Gitea 模板 仓库同步到磁盘时 未对条目名称进行清理，允许已认证的低权限用户 通过目录遍历以 root 身份写入任意文件——此处用于将 SSH 密钥 植入 /root/.ssh/authorizedkeys。 ⚠️ 免责声明 此代码仅供教育目的和授权安全测试 使用 ——即 HackTheBox 等实验环境，或您拥有或已获得...
CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
CVE-2026-7726
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...