Vuln_Exploitation_MegaQuagga_Pentest

Explotación de Vulnerabilidades — Informe de Prueba de Penetración de MegaQuagga Analista: Samuel Weiss Organización: 0x2A Security Fecha: 20 de abril de 2026 Cliente: MegaQuagga Publishing Objetivo: www.megaquagga.local Clasificación: CONFIDENCIAL Resumen Este proyecto documenta una prueba de...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

CVE-2026-40022

Bypass de autenticación en rutas de contexto no raíz de camel-platform-http-main CVE-2026-40022 Este proyecto demuestra un bypass de autenticación en el componente camel-platform-http-main de Apache Camel el servidor HTTP/de gestión integrado del runtime main de Camel, registrado como...

CVE-2026-35030-PoC

CVE-2026-35030 — Bypass de autenticación en LiteLLM mediante colisión de clave de caché de userinfo OIDC LiteLLM utiliza token:20 como clave de la caché de userinfo OIDC. Dos JWTs distintos firmados con el mismo algoritmo producen los primeros 20 caracteres idénticos , lo que permite a un atacant...

CVE-2026-35273

CVE-2026-35273 Esta alerta de seguridad aborda la vulnerabilidad CVE-2026-35273 en Oracle PeopleSoft PeopleTools. Los clientes de Oracle PeopleSoft Enterprise Applications también pueden verse afectados por esta vulnerabilidad. Esta vulnerabilidad es explotable de forma remota sin autenticación. ...

CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator RCE sin autenticación Ejecución remota de código sin autenticación crítica en Fortinet FortiAuthenticator 📋 Resumen CVE-2026-44277 es una vulnerabilidad crítica en Fortinet FortiAuthenticator que permite a atacantes no autenticados lograr ejecución remota de...

CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Crawl4AI Ejecución Remota de Código No Autenticada Evasión de Sandbox AST RCE previa a la autenticación en Crawl4AI.read — devolviendo la salida del comando en banda en la respuesta JSON...

CVE-2026-84818

CVE-2026-84818 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Open User Map plugin in versions 1.4.50 and below . The vulnerability is rated HIGH with a CVSS 3.1 score of 7.1 (vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), assigned by Patchstack . The attack...

EUVD-2026-72646

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...

CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...

CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...

CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84817

CVE-2026-84817 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress JetFormBuilder plugin in versions 3.6.5.1 and earlier . The flaw is reachable over the network with low complexity and no prior authentication, though user interaction is required. The CVSS 3.1 s...

CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

EUVD-2026-72647

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

EUVD-2026-72645

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802

WpEvently (WordPress plugin, also listed as Mage EventPress) versions ≤ 5.6.0 contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating a network-exploitable issue requiring...

CVE-2026-81792 WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX = 6.1.4 versions...