CVE-2026-71298 Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database. Mitigation To mitigate this...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713

The Apache Struts framework is vulnerable to an allocation of resources without limits or throttling (CWE-770) within the REST plugin . The root cause is that a request body is read into memory without any size bounds, allowing a single request to exhaust the Java heap and cause a denial of servi...

com.jgeppert.struts2:struts2-aws-lambda-support-example (>=1.4.0, <=1.4.3), com.jgeppert.struts2:struts2-aws-lambda-support-plugin (>=1.4.0, <=1.4.3) +3 more potentially affected by CVE-2026-104713 via org.apache.struts:struts2-rest-plugin (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-rest-plugin MAVEN version =6.0.0, =1.4.0, =1.4.0, =1.4.0, =6.0.0, =6.0.0, =6.11.0 Source cves: CVE-2026-104713 Source advisory: MEND:CVE-2026-104713...

org.apache.struts:struts2-assembly (>=7.0.0, <=7.3.0), org.apache.struts:struts2-rest-showcase (>=7.0.0, <=7.3.0) potentially affected by CVE-2026-104713 via org.apache.struts:struts2-rest-plugin (>=7.0.0, <=7.3.0)

org.apache.struts:struts2-rest-plugin MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.3.0 Source cves: CVE-2026-104713 Source advisory: MEND:CVE-2026-104713...

EUVD-2026-92624

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2025-32044

CVE-2025-32044 — Moodle Unauthenticated REST API User Data Exposure Stack Trace Args Leak → Names, Emails, Password Hashes Overview CVE-2025-32044 is a high-severity CVSS 7.5 unauthenticated information disclosure vulnerability in Moodle LMS 4.5.0 through 4.5.2. The vulnerability lies in Moodle's...

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin WooCommerce Multivendor Marketplace – REST API versions = 1.6.3...

wp2shell-poc

wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

CVE-2026-33137

CVE-2026-33137 XWiki Platform - Importación XAR no autenticada vía REST/wikis/wikiName Descripción El endpoint de la API REST POST /wikis/wikiName en XWiki Platform ejecuta una importación de XAR XWiki Archive sin realizar ninguna verificación de autenticación o autorización. Un atacante no...

CVE-2023-23752

CVE-2023-23752 - Reaparición de la vulnerabilidad de acceso no autorizado de Joomla Uso del script Instalar la biblioteca de python pip install -r requirements.txt Verificación de vulnerabilidad python3 CVE-2022-26134check.py -u url -c whoami Escaneo por lotes python3 CVE-2023-23752.py -f...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71298: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

PT-2026-106190

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-104713: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...