gakigaki

6 exploits Active since Mar 2026
CVE-2026-32279 WRITEUP MEDIUM WRITEUP
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 6.8
CVE-2026-32276 WRITEUP HIGH WRITEUP
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 8.8
CVE-2026-32277 WRITEUP HIGH WRITEUP
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 8.7
CVE-2026-32279 WRITEUP MEDIUM WRITEUP
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 6.8
CVE-2026-32278 WRITEUP HIGH WRITEUP
Connect-CMS 1.x-1.41.0/2.x-2.41.0 - Stored XSS
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 8.2
CVE-2026-32300 WRITEUP HIGH WRITEUP
Connect-CMS 1.x-1.41.0/2.x-2.41.0 - Privilege Escalation
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.
CVSS 8.1