CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-97311

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2017-12542

CVE-2017-12542 This script checks if an HP iLO server is vulnerable and can add an admin user...

CVE-2025-64027

Información del Producto Snipe-IT es un sistema de gestión de activos de TI gratuito y de código abierto FOSS construido sobre Laravel. Proporciona seguimiento de activos de hardware, gestión de licencias de software, accesorios e inventario de consumibles para equipos de operaciones de TI. Se...

Exploit_CVE-2021-24762

exploitcve-2021-24762 Este repositorio muestra un exploit para CVE-2021-24762. Es un exploit de Blind SQLi que, en la configuración predeterminada, obtiene la contraseña del administrador. Mientras realizaba un laboratorio, basado en WordPress con el plugin PerfectSurvey, me topé con una...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Divi Form Builder versions = 5.1.2 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated...

CVE-2025-66947

CVE-2025-66947 Inyección SQL ciega basada en tiempo en krishanmuraiji SMS v1.0 ⏱️ Comparación visual: respuesta normal vs respuesta retardada 6s 🔍 Resumen TL;DR: Un parámetro GET en un módulo administrativo permite inyección SQL basada en tiempo mediante retardos en la respuesta. Existe una...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authentication Bypass to Admin Account Takeover Vulnerability Summary The WordPress plugin Burst Statistics versions 3.4.0 to 3.4.1.1 is vulnerable to an unauthenticated authentication bypass vulnerability that leads to full administrator account...

fortigate-cve-2022-40684-tool

Description This tool allows security professionals to identify and validate exposure to CVE-2022-40684 in FortiGate devices by interacting with exposed CMDB API endpoints. It supports enumeration of administrative users, user groups, and selective configuration extraction for analysis in...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-38526-PoC-htb-nexus

CVE-2026-38526-PoC-htb-nexus A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x built for htb-nexus 🛠 Quick start and Usage 1. Clone the repository: git clone https://github.com/Resolvdd/CVE-2026-38526-PoC-htb-nexus.gi...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw in the Keycloak Admin REST API user update mechanism allows for a permission bypass when Fine-Grained Admin Permissions are enabled. The system fails to validate specific password reset authorizations during general user profile updates. This allows a delegated administrator —who should be...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - 认证绕过，提取管理员用户和LDAP配置 - 此PoC仅执行只读操作。 运行漏洞利用 USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com 运行nuclei模板 echo https://target.com | nuclei -t CVE-2022-40684.yaml...

CVE-2026-96810

A cross-site scripting (XSS) vulnerability exists in the huanzi-qch base-admin software (up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1). The flaw is located within the Add User Handler component, specifically affecting the Save function of the base-admin-master\src\main\java\cn\huanzi\qch...

CVE-2026-96810 huanzi-qch base-admin Add User CommonController.java save cross site scripting

A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The...

EUVD-2026-85674

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

EUVD-2026-85710

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...