CVE-2026-19948

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-19806

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2022-43704

CVE-2022-43704 - Canal accessible par un non-point de terminaison / Contournement d'authentification par rejeu Sinilink XY-WFTX Module thermostat Wi-Fi, contrôleur de température Titre Documentation du produit Application Manuel d'utilisation Matériel Fiches techniques ESP8285 Buck Converter...

cve-2025-32434-poc

CVE-2025-32434 Description Détails techniques Le point d'entrée de la vulnérabilité est load dans torch/serialization.py lorsque la protection weightsonly est activée : le chargement d'un fichier tar appellerait ces fonctions en chaîne : 1. load : torch/serialization.py:1117 2. loadlegacy :...

CVE-2025-67159

CVE-2025-67159 — Caméras IP basées sur Vatilon Résumé Le firmware des caméras IP basées sur Vatilon contient une vulnérabilité de contournement d'authentification et d'exposition d'identifiants en clair dans l'API /cgi-bin/web.cgi. L'interface web traite les requêtes contenant les paramètres...

CVE-2024-34102

CVE-2024-34102 POC pour CVE-2024-34102 : XXE Magento non authentifié et contournement du WAF, vous obtiendrez une connexion HTTP sur votre webhook root@kitploit: POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2 Host: example.com Accept: application/json, text/javascript, /; q=0.01...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- 13 февраля 2024 года Microsoft опубликовала критическую уязвимость безопасности в Microsoft Outlook, получившую идентификатор CVE-2024-21413 и известную как Moniker Link Vulnerability. Уязвимость позволяет злоумышленнику обойти механизм Protect...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST 認証バイパス RCE。 root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host...

vulnerable-nextjs-14-CVE-2025-29927

Reproduction du contournement d'autorisation CVE-2025-29927 Ce dépôt est une reproduction de la vulnérabilité CVE-2025-29927 dans le paquet next Comment reproduire 1. Suivez les étapes ci-dessous pour cloner et exécuter l'application Next.js 2. Vérifiez que l'autorisation refuse l'accès au point ...

CVE-2026-83743 invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2026-83743

Invoice Ninja versions up to 5.13.26 are affected by an authorization bypass in the Vendor Portal Profile Update component (file /vendor/profile/). By manipulating the vendor_contact argument, a remotely authenticated user (low privileges) can bypass access controls, resulting in low impact on co...

EUVD-2026-68981

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2026-83743 invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendorcontact can lead to authorization bypass. The attack may be performed...

CVE-2023-27350-PoC

CVE-2023-27350 Ce PoC démontre comment il est possible de contourner l'authentification dans PaperCut MF/NG versions à partir de 8.0 jusqu'à, mais sans inclure, 20.1.7, 21.2.11 et 22.0.9. Il permet l'interaction avec le système sans utiliser d'identifiants de connexion valides. Requêtes Shodan 1...

CVE-2018-12633-TPLink-Auth-Bypass

CVE-2018-12633-TPLink-Auth-Bypass Une étude de cas technique et une analyse d'exploitation de la vulnérabilité de contournement d'authentification dans le firmware TP-Link TL-WR840N CVE-2018-12633. Analyse de vulnérabilité : Contournement d'authentification TP-Link TL-WR840N CVE-2018-12633 ⚠️...

CVE-2026-19948 Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

EUVD-2026-68980

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-19806 Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

EUVD-2026-68969

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guestticketlogin function and its p parameter. Th...

CVE-2026-19806

The Support Genix WordPress plugin (≤ 1.4.52 ) is vulnerable to Authentication Bypass leading to Administrator Account Takeover via its guest_ticket_login() function and the publicly reachable /sgnix/?p= endpoint. The root cause is a weak site-wide AES-256-CBC encryption key derived from three tw...