CVE-2022-2414

CVE-2022-2414 CVE-2022-2414 POC 1. Замените YOURHOST на вашу цель, как в URL ниже url = "https://example.com/ca/rest/certrequests"...

CVE-2025-54320

CVE-2025-54320 Email-бомбинг приглашения пользователя Описание API приглашений не реализует ограничение частоты запросов rate limiting для целевого адреса электронной почты. Это позволяет проводить атаку Email Bombing. CVSS Score: 7.1 Высокий Тип атаки Удалённая с аутентификацией Затронутые верси...

CVE-2022-1388

CVE-2022-1388 Проверка и эксплуатация CVE-2022-1388 Установка: python3 -m pip install -r requirements.txt Использование Одиночный : python3 cve.py s fullurl apicommand example python3 cve.py s http://127.0.0.1:8000/mgmt/tm/util/bash '"command":"run","utilCmdArgs":"-c id"' Массовый : python3 cve.p...

CVE-2015-3073

CVE-2015-3073 Эта уязвимость позволяет удалённым злоумышленникам обходить ограничения API в уязвимых установках Adobe Reader. Для эксплуатации этой уязвимости требуется взаимодействие с пользователем: жертва должна посетить вредоносную страницу или открыть вредоносный файл. Конкретная ошибка...

CVE-2025-31161

CVE-2025-31161 - Эксплойт обхода аутентификации CrushFTP Этот скрипт на Python эксплуатирует CVE-2025-31161, уязвимость обхода аутентификации в CrushFTP, позволяющую неаутентифицированным злоумышленникам получать список пользователей из API-эндпоинта getUserList. Особенности Обход аутентификации...

CVE-2025-9074

CVE-2025-9074 – Полный выход из Docker на Windows и macOS Docker Desktop 📌 Описание Docker Desktop открывает внутренний API Docker Engine по адресу http://192.168.65.7:2375 для любого работающего контейнера — без аутентификации и без контроля доступа. Поскольку сам движок может монтировать файлов...

CVE-2026-103281

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103275

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103264

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

EUVD-2026-90674

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281

The Ghost (npm package 'ghost') content management system versions 3.23.0 up to, but not including, 6.23.0 contains a vulnerability where it exposes API keys to users with low-privilege staff accounts. The root cause allows an authenticated low-privilege staff user to read API keys returned by th...

EUVD-2026-90668

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103275

The Ghost content management system (versions 5.42.2 before 6.58.0 ) is vulnerable to an information disclosure vulnerability. The issue exists in the Admin API bulk post, and the page edit and delete endpoints, which allow filters on restricted fields like authors.password . This is caused by an...

CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...