1833 matches found
CVE-2026-96270
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...
EUVD-2026-91876
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...
CVE-2022-40684
CVE-2022-40684 CVE-2022-40684 - Omisión de autenticación para extraer usuarios administradores y configuración LDAP - Este PoC solo realiza acciones de solo lectura. Ejecutar exploit USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Ejecutar plantilla de nuclei...
audit_couchdb
Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...
CVE-2022-40684
CVE-2022-40684 CVE-2022-40684 - Omisión de autenticación para extraer usuarios administradores y configuración LDAP - Esta PoC solo realiza acciones de solo lectura. Ejecutar exploit USE: python3 exploit.py https://target.com Ex: python3 exploit.py https://target.com Ejecutar plantilla nuclei ech...
CVE-2026-64638
CVE-2026-64638 Donar Apoya el mantenimiento de este proyecto con PayPal o escaneando el código QR a continuación. ⚡ Uso sencillo Usa este proyecto únicamente en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de...
CVE-2026-100303
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users...
CVE-2026-100303
The TDuck survey form (versions through 6.0 ) is vulnerable to a broken access control issue due to missing authorization checks on the FormThemeController write endpoints. This allows authenticated non-admin users to perform unauthorized actions, such as adding, modifying, or deleting global for...
CVE-2026-61745
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...
CVE-2026-10030
IBM MQ versions 9.3 LTS, 9.4 LTS, 9.3 CD, 9.4 CD, and 10.0.0.0 are affected by an improper authorization flaw (CWE-285) in the REST API and Console component. An authenticated non-administrative user with only read-only console access can create and start queue managers on the host, leading to pr...
CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation
IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...
CVE-2026-88959: Missing Authorization
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
Linux Distros Unpatched Vulnerability : CVE-2026-86090
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...
CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-84989
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717 , two REST v2 endpoints managing the tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check . Any authenticated non-administ...
PT-2026-84674
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-80488: Improper Neutralization of Special Elements used in an SQL Command
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...
CVE-2026-56720
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...
CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...