#CMS
All CosmicBytez Labs articles tagged #CMS, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-52539: Hardcoded JWT Secret in Outstatic CMS Enables Admin Takeover
Outstatic CMS versions up to and including 2.1.9 ship a publicly known default JWT signing secret, allowing unauthenticated attackers to forge valid admin...
- Security
CVE-2026-65007: Grav API Plugin Broken Authorization Allows API Key Takeover
The Grav CMS API plugin before version 1.0.8 fails to properly authorize API key generation and revocation, allowing low-privilege users to generate admin...
- Security
CVE-2026-65008: Grav CMS RCE via Uncontrolled Callable in Blueprint::dynamicData()
Grav CMS 2.0.4 contains a critical remote code execution vulnerability where Blueprint::dynamicData() passes attacker-controlled callable strings directly...
- News
iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
CISA has added two maximum-severity flaws in iCagenda and Balbooa Forms Joomla extensions to its KEV catalog following confirmed zero-day exploitation in...
- News
Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms
The Australian Cyber Security Centre has issued an alert about a coordinated global campaign actively exploiting unpatched vulnerabilities in WordPress,...
- News
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
CISA has added a maximum-severity vulnerability in the Joomla Content Editor (JCE) plugin to its Known Exploited Vulnerabilities catalog, warning that the...
- Security
CVE-2026-48907: Joomla Content Editor Unauthenticated PHP Upload Flaw
A maximum-severity improper access control flaw in Widget Factory's Joomla Content Editor allows unauthenticated attackers to upload and execute arbitrary...
- Security
CVE-2026-36748: High-Severity Stored XSS in RockRMS via Social Media Profile Links
RockRMS versions up to v16.13 are vulnerable to a CVSS 9.0 stored cross-site scripting flaw that allows attackers to inject malicious scripts through social…
- News
Drupal Patches Highly Critical Vulnerability Exposing
Drupal has released an urgent security update for CVE-2026-9082, a highly critical flaw that can be exploited without authentication to achieve...
- Security
Typecho 1.3.0 Pingback SSRF via X-Pingback Manipulation
A CVSS 7.3 server-side request forgery vulnerability in Typecho up to 1.3.0 allows attackers to manipulate the X-Pingback/link argument in Service.php to...
- Security
CVE-2025-2749: Kentico Xperience Path Traversal
Kentico Xperience contains a path traversal vulnerability allowing an authenticated user's Staging Sync Server to upload arbitrary data to relative path...
- Security
CVE-2026-39918: Vvveb CMS Unauthenticated PHP Code
Vvveb CMS versions prior to 1.0.8.1 allow unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's unsanitized subdir...
- Security
CVE-2026-25776: Movable Type Critical Code Injection (CVSS
Six Apart's Movable Type CMS contains a critical code injection vulnerability allowing unauthenticated attackers to execute arbitrary Perl scripts on...