mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Sat Aug 1 12:00:33 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
9237814e94
commit
34a9e13075
103 files changed
+1216
-5
No files matched your search
@@ -11,6 +11,7 @@ The WordPress plugin is-human <= v1.4.2 contains an eval injection vulnerabili
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/17299
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-alert-more-wordpress-is_human-plugin-remote-command-injection-attack-detected/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyz
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
|
||||
- http://www.exploit-db.com/exploits/18750
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFl
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
|
||||
- http://www.exploit-db.com/exploits/18750
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer Inte
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
|
||||
- http://www.exploit-db.com/exploits/18750
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in P
|
||||
#### Reference
|
||||
- http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
|
||||
- http://www.exploit-db.com/exploits/18750
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earli
|
||||
|
||||
#### Reference
|
||||
- https://www.exploit-db.com/exploits/22216
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-016-multiple-vulnerabilities-in-bitweaver/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2017-20204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-20204)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet administrative interface that allows remote authentication as an undocumented user via a proprietary challenge–response scheme which is fundamentally flawed. Because the challenge response can be computed from the challenge itself, a remote attacker can authenticate without knowledge of a secret and obtain a root shell on the device. This can lead to persistent remote code execution, full device compromise, and arbitrary control of the device and any managed services. The firmware used within these devices was updated in December 2016 to make this vulnerability more complex to exploit. However, it is unknown if DBLTek has taken steps to fully mitigate.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/undocumented-backdoor-account-in-dbltek-goip/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-15652-satlink-vsat-vulnerabilities/
|
||||
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26455
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -10,7 +10,7 @@ Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted req
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-denial-of-service-details-cve-2019-19886/
|
||||
|
||||
#### Github
|
||||
- https://github.com/Coldplay1517/Middleware-Vulnerability-detection-master
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2019-8983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8983)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2019-8984](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8984)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -14,6 +14,7 @@ In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows super
|
||||
- http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
|
||||
- http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
|
||||
- https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/
|
||||
|
||||
#### Github
|
||||
- https://github.com/0xT11/CVE-POC
|
||||
|
||||
@@ -10,6 +10,7 @@ Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/solarwinds-serv-u-1523-share-url-xss-cve-2021-32604/
|
||||
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29000
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafte
|
||||
|
||||
#### Reference
|
||||
- https://www.oracle.com/security-alerts/cpuapr2022.html
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
|
||||
|
||||
#### Github
|
||||
- https://github.com/EkamSinghWalia/Detection-and-Mitigation-script-for-CVE-2021-42717
|
||||
|
||||
@@ -10,6 +10,7 @@ Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference cause
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2023-38285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38285)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2023-6507](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6507)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ The pathname of the root directory to a Restricted Directory ('Path Traversal')
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://seclists.org/fulldisclosure/2024/Nov/8
|
||||
- https://cyberdanube.com/en/en-st-polten-uas-path-traversal-in-korenix-jetport/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2024-12254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12254)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2024-12718](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12718)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -11,6 +11,7 @@ The "NagVis" component within Checkmk is vulnerable to remote code execution. An
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://seclists.org/fulldisclosure/2025/Feb/4
|
||||
- http://www.openwall.com/lists/oss-security/2025/02/04/4
|
||||
- https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1aGLAFz20-fc7ZLiWouegyK_65jCkGTDb/view?usp=sharing
|
||||
- https://rashidkhanpathan.github.io/posts/CVE-2024-26317-Elliptic-curve-point-addition-error/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -11,6 +11,7 @@ Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://seclists.org/fulldisclosure/2025/Jan/6
|
||||
- https://gist.github.com/opcod3r/ab69f36d52367df7ffac32a597dff31c
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
### [CVE-2024-4944](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4944)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
### [CVE-2024-5642](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-0938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-15669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15669)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/69800fa9-4fbd-489c-8759-96df745d77d6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-1795](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1795)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-4138](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-4330](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-4435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-4516](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-4517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permission
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://youtu.be/2DScqXPtrWw
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-6069](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-8194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8194)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2025-8291](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10827)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/068ac525-423b-42f8-9ef4-f102f948dc78/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10918)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/498259721
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10994](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10994)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/504820809
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10997)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/464217867
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11009](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11009)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/496233132
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11087)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/500140149
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11109](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11109)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/500524833
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11135](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11135)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/501644835
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11138](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11138)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/501650354
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11198)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/504395300
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11221)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/492211919
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11882](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11882)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/23e0eb03-ec19-4cec-8127-cb6c2c2f4d7b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-12696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12696)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0dde2d89-267f-4aca-b2f0-d086b15adff0/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-12966](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12966)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b2b7f90e-359f-4fb4-9b48-c87ecb229f76/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13157](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13157)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13158](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13158)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f101071f-402a-40a2-bbdb-666512cd4049/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13329](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13329)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6e60d271-574d-4259-ab51-32a014e480d4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13596)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e22227c8-506e-4188-a7a1-1952b41c47f5/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13604)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/766c961e-e5aa-4ebe-8107-032f46316f91/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13725](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13725)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/5e3786de-4b4d-4da2-b129-7b0fef90a386/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13729](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13729)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14195)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14197)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14214)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14292)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14309)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14315)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/0d7c113a-b677-4687-a077-ec0ec7deff83/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14317)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fa6f5470-b30d-4052-aacd-a0571d4678ac/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14561)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/4025601f-ed33-4772-b716-a9979830e10d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14596)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/a23eb55c-f5b1-4dcb-8d53-6e71d80e050a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14822](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14822)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ec32cf58-9fc0-4817-8492-92d80be74ef4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14823](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14823)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/50fcd505-11bc-4208-aa27-54651f82e80e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14836](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14836)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/9bdb7959-dbe7-4f48-892b-b9ee4c8eb060/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14839)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14840)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/fc810ca2-3f27-414d-b94a-68842925b7c6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15234)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/519a69d5-ab6f-449a-ab78-78b68598d37f/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15244)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15262](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15262)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15368)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15932)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/d03887a5-1a0e-4097-8dfa-7899aae8a6d5/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ A vulnerability was detected in itsourcecode Society Management System 1.0. This
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yyzq-wsx/for_cve/issues/1
|
||||
- https://vuldb.com/?ctiid.343357
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-29519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29519)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/L4V4D0/CVE-2026-29519-Lucee-Reflected-XSS
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-43760](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43760)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-51785](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51785)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://fenrisk.com/hiawatha-http-smuggling
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-51953](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51953)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/altamish1994/CVE_Published/blob/main/FeehiCMS/CVE-2026-51953.MD
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-52371](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52371)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/RichardKabuto/xxl-job-ssrf-poc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
|
||||
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-59231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59231)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://secur0.com/en/cna/cve-list/cve-2026-59231-ssrf-in-pentestify-via-unvalidated-image-urls-cve-id-cve-2026-59231
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-59232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59232)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -23,6 +23,9 @@ In the Linux kernel, the following vulnerability has been resolved:net: openvswi
|
||||
|
||||
#### Reference
|
||||
- http://www.openwall.com/lists/oss-security/2026/07/28/8
|
||||
- http://www.openwall.com/lists/oss-security/2026/07/31/17
|
||||
- http://www.openwall.com/lists/oss-security/2026/08/01/1
|
||||
- http://www.openwall.com/lists/oss-security/2026/08/01/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-65636](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65636)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected.This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2.This issue affects ymlr from 0.0.1 before 5.1.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://cna.erlef.org/cves/CVE-2026-65636.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Action Pack is a framework for handling and responding to web requests. In versi
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066
|
||||
- https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66729](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66729)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tpaidakis.com/writeups/facilio-parser-dos/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66730](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66730)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tpaidakis.com/writeups/facilio-parser-dos/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66731](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66731)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.h to compute a large positive integer from the negated value, corrupting internal state and moving the read pointer into unmapped memory resulting in a fault.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://tpaidakis.com/writeups/facilio-parser-dos/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/
|
||||
- https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher with a static key applied to the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.
|
||||
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-67607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67607)
|
||||
|
||||
|
||||
%20Race%20Condition&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/zeroscience/tuktam#real-world-case-study-lightftp-cve-2024-11144
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-7926](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7926)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/502249087
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-8002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8002)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/495779613
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-9872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9872)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/505077859
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-9880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9880)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/503615025
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-9932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9932)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/501563323
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 103 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user