tag
Cms
WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")
CVE-2026-64638 — nicknamed XSS2Shell by its discoverers at pwn.ai — is a pre-authentication reflected XSS in the WordPress login page that chains through five to seven stages into full remote code execution on the server. It is one of the most impactful…
Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)
iCagenda's frontend event-registration form includes an optional file-attachment field. The "Registered Only" access restriction meant to gate that field is enforced only in the view layer that decides whether to render the form — the registration.submit…
Sitecore XP Report.ashx Insecure Deserialization RCE (CVE-2021-42237)
Sitecore Experience Platform ships a legacy, unused reporting handler at /sitecore/shell/ClientBin/Reporting/Report.ashx that is reachable without authentication. The handler deserializes an attacker-supplied XML <parameters> block using…
VvvebJs SVG Upload Stored Cross-Site Scripting — CVE-2026-5615
VvvebJs versions <= 2.0.5 allow uploading SVG files without sanitizing their contents. Because SVG is XML that can embed <script>-equivalent event handlers (e.g. onload), an attacker can upload an SVG containing JavaScript, which is stored server-side and…
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
TypiCMS Core allows users with file-upload permission to upload SVG files, validating only the MIME type without sanitizing the SVG's internal content. Because SVG is an XML-based format that can embed <script> tags, an attacker can upload a malicious SVG…
Strapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886
Strapi's Content API allows unauthenticated query-parameter filtering on collection endpoints (e.g. /api/articles) that leaks internal relation data through a boolean oracle. The PoC abuses a where-style filter bypass to enumerate the admin user's email…
Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290
The Joomla extension Page Builder CK exposes a controller method, browse.ajaxAddPicture, that accepts file uploads with a user-controlled destination path parameter (path) that is only passed through trim() — no whitelist, extension check, or…
Joomla Novarain Framework (nrframework) Unauthenticated Arbitrary File Inclusion — CVE-2026-21627
The ajaxTaskInclude() method of the nrframework Joomla plugin is explicitly whitelisted for unauthenticated frontend AJAX access and accepts attacker-controlled path, file, and class parameters. The path parameter uses Joomla's RAW input filter (no…
HAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)
The hmacBase64() function in HAXcms's Node.js backend contains two cryptographic flaws: it signs data with the hard-coded literal key "0" instead of the real signing key, and then appends the real key (privateKey + salt) in plaintext onto the returned token.…
HAXcms Git.php OS Command Injection (CVE-2026-46394)
HAXcms's Git.php library builds shell command strings by concatenating unsanitized parameters and executes them via procopen(). Of the 17 functions that shell out, only commit() escapes its input with escapeshellarg() — the remaining 15, including…
Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099)
Bludit CMS's POST /api/files/<page-key> endpoint lets any holder of a valid API token upload files to a page without validating file extension or content, so a PHP file can be uploaded and dropped directly under the web-accessible uploads directory. Once…
Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415
Before Azuriom 1.2.11, the admin panel's server-management routes (/admin/servers/) had no dedicated permission gate — any admin-panel user with just the base admin.access permission could reach them, since the admin.servers permission did not exist yet.…
ApostropheCMS Import — Malicious Tar Archive Path Traversal (CVE-2026-32731)
ApostropheCMS supports importing a site/content archive (.tar.gz) containing aposDocs.json and aposAttachments.json metadata files. The import handler does not validate that entries extracted from the archive stay within the intended extraction directory,…
Unauthenticated RCE in Joomla Content Editor (JCE) Profile Import (CVE-2026-48907)
CVE-2026-48907 is a critical improper access control vulnerability in the JCE extension for Joomla. The profile import workflow (index.php?option=comjce&task=profiles.import) is missing sufficient authorization checks, letting unauthenticated users create new…
SP Page Builder (Joomla) Unauthenticated File Upload RCE (CVE-2026-48908)
CVE-2026-48908 is a CVSS 10.0 unauthenticated remote code execution vulnerability in SP Page Builder, one of the most widely used Joomla page-builder extensions (joomshaper.net). The asset.uploadCustomIcon endpoint enforces no authentication, no…