CVE-2026-5391
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVSS Skor
6.4
EPSS İhtimal
%0.3
Risk Skoru
0.0
Yayın
2 ay önce
Public Exploits · GitHub ve Metasploit Intelligence
Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.
GitHub
PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.
Makefile Go / Python
İlgili Benzer Açıklar
9.1
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
L
Yama durumu bilinmiyorEPSS %0
7.5
CVE-2026-103366
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
L
Yama durumu bilinmiyorEPSS %0
7.4
CVE-2026-100163
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
L
Yama durumu bilinmiyorEPSS %0
7.5
CVE-2026-96662
Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
L
Yama durumu bilinmiyorEPSS %0
8.8
CVE-2026-104766
Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
L
Yama durumu bilinmiyorEPSS %0
4.3
CVE-2026-13471
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
L
Yama durumu bilinmiyorEPSS %0
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-5391"