CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0 , the POST /api/auth/token endpoint authenticates users with only username and password, then calls getTokens(), which returns full access and refresh JWTs without checking whet...

CVE-2026-58269 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2026-58271

Sync-in Server , an open-source platform for file storage and collaboration, is vulnerable to TOTP brute-force in versions prior to 2.4.0 . The endpoint POST /api/app/sync/register fails to increment the passwordAttempts counter on TOTP failure due to a freeze branch in updateAccesses(), so the l...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2017-14980

CVE-2017-14980 Sync Breeze Enterprise 10.0.28 - Investigación de Desbordamiento de Búfer Objetivo Estudio de una vulnerabilidad clásica de desbordamiento de búfer basado en pila en un entorno de laboratorio controlado con fines educativos. El objetivo de este proyecto era comprender mejor: Fuzzin...

CVE-2026-28672

CVE-2026-28672 — Inyección de comandos del sistema operativo en UnixUserGroupBuilder de Apache Ranger Reproductor de prueba de concepto ejecutable para la inyección de comandos del sistema operativo en el módulo de sincronización de usuarios unixusersync de Apache Ranger. Mientras enumera los...

CVE-2026-15718-who-put-ptrs-in-my-wasm

CVE-2026-15718 — quién metió punteros en mi wasm Cadena de exploits de prueba de concepto para CVE-2026-15718 , una mala compilación por falta de sync en el compilador baseline de WebAssembly de Mozilla SpiderMonkey componente «JavaScript: WebAssembly». Un único array.fill de cero iteraciones...

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 🐚 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 📝 Description The KiotViet Sync plugin for WordPress versions up to and including 1.8.5 is vulnerable to arbitrary file uploads, due to missing file type...

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass My version - Win10 x64 CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass...

Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-

Nexus — PoC de Escalada de Privilegios Locales Path traversal en la sincronización de plantillas de Gitea mediante objetos Git falsificados → root Un exploit de prueba de concepto para la escalada de privilegios en la máquina de HackTheBox Nexus. Un servicio systemd propiedad de root sincroniza l...

CVE-2025-32579

⚠️ CVE-2025-32579 - Critical RCE via Sync Posts Plugin WordPress 📦 Affects: Sync Posts 🧨 CVSS Score: 9.9 CRITICAL 📁 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Vulnerability Overview The Sync Posts WordPress plugin by SoftClever Limited is vulnerable to an Unrestricted File Upload...

CVE-2017-14980_syncbreeze_10.0.28_bof

Exploit - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 This repository contains a proof-of-concept buffer overflow exploit BOF for Sync Breeze Enterprise version 10.0.28, targeting the vulnerability identified as CVE-2017-14980. Description The vulnerability exists due to improper input...

CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2017-14980

Exploit-CVE-2017-14980 PoC exploit for CVE-2017-14980 — a stack-based buffer overflow vulnerability in Sync Breeze Enterprise 10.0.28. 📖 Full technical analysis of the exploit: 👉 https://davigsantana.github.io/posts/buffer-overflow/ About This repository contains a proof-of-concept PoC developed...

CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass

CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass My version - CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass on Win7 x64 CVE-2018-6892...

revsync

revsync Plugin de sincronización en tiempo real para IDA Pro, Binary Ninja y Vivisect Sincroniza: Comentarios Nombres de símbolos Nombres de variables de pila Estructuras Cobertura de código cuánto tiempo se pasó mirando un bloque Instalación de IDA Pro Primero, clona al directorio de datos de ID...

Mailcow-CVE-2022-31138

Mailcow CVE-2022-31138 RCE and Domain Admin privilege escalation for Mailcow. POC for CVE-2022-31245 can be modified to work with this vulnerability. Reported and fixed: 2022-06 Code Injection, RCE Type: Code Injection CWE-94, RCE, Domain Takeover Affected versions: least 2019 - 2022-06a A flaw...

EUVD-2026-83263

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...