184 matches found
CVE-2023-43208
CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept exploit for CVE-2023-43208 , an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to 4.4.1. Description Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages ...
CVE-2023-43208
CVE-2023-43208 Mirth Connect RCE PoC Proof-of-concept Python script targeting CVE-2023-43208 in Mirth Connect. Disclaimer Use only in environments you own or are explicitly authorized to test. This repository is for security research, validation, and defensive testing. The author assumes no...
Giuseppe Barchetta SuggestArr Authorization Issue Vulnerability
Giuseppe Barchetta’s SuggestArr version 3.0.0 and earlier have a vulnerability related to authorization. This vulnerability stems from the enforceauthentication function in the localbypass authentication mode. In this mode, the requestremoteaddr value is controlled by the client. However, this...
CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...
CVE-2026-111681
The EFAK software (versions through 5.1.0 ) is vulnerable to privilege escalation due to a missing authorization flaw in the /api/users REST API endpoints. The UserController fails to perform necessary administrator role checks, allowing authenticated users with low privileges to execute POST , P...
CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...
CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
CVE-2026-111626
The Webreaper Damselfly software (through version 4.5.3 ) is vulnerable to an authentication bypass because controller authorization attributes are commented out. This flaw allows unauthenticated attackers to access all */api/ routes. By sending a PUT /api/users request with Admin roles, an attac...
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...
CVE-2026-111604
The eladmin framework, versions through 2.7 , is vulnerable to an authorization bypass (CWE-639) within the /api/users endpoints. The root cause is that write handlers skip mandatory department checks , allowing department-scoped user managers to exceed their intended data scope. An attacker poss...
EUVD-2026-103026
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...
CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...
CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...
EUVD-2026-102836
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-111681: Missing Authorization
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...
CVE-2026-111626: Missing Authentication for Critical Function
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...
CVE-2026-111604: Authorization Bypass Through User-Controlled Key
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...