CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

EUVD-2026-95027

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

PT-2026-107999

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset key...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

EUVD-2026-92078

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

Gitlab -- vulnerabilities

Gitlab reports: Improper Access Control issue in Group SAML Identity API impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE Denial of Service issue in Grape API JSON parsing middleware impacts GitLab CE/EE HTML injection issue in certain group setting fields...

scramble - Remote Code Execution

Exploit Title: scramble - Remote Code Execution Google Dork: inurl:/docs/api.json "dedoc/scramble" Date: 2026-05-07 Exploit Author: Joshua van der Poll https://github.com/joshuavanderpoll Vendor Homepage: https://scramble.dedoc.co Software Link: https://github.com/dedoc/scramble Version: =0.13.2,...

Malicious code in nodeapi-json (npm)

The package nodeapi-json was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adf38cc7ff9fedd8e0e5018c03c9141360823a8c5143181264185160ee040728 Any computer that has this package installed or running should be considered fully...

CVE-2025-55156: Improper Neutralization of Special Elements used in an SQL Command

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter addlinks in API /json/addpackage is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched ...

Exploit for Command Injection in Zohocorp Manageengine_Admanager_Plus

CVE-2023-29084 Command injection in ManageEngine ADManager Plu...

PT-2022-10477

Name of the Vulnerable Software and Affected Versions Foreman project affected versions not specified Description A flaw was found in the Foreman project, where a credential leak exposes the Azure Compute Profile password through JSON of the API output. The highest threat from this issue is to da...

Information Exposure

Overview foremanazurerm is a This gem provides Azure Resource Manager as a compute resource for The Foreman Affected versions of this package are vulnerable to Information Exposure. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API...

CVE-2021-3413

A flaw was found in Red Hat Satellite in tfm-rubygem-foremanazurerm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity ...

UBUNTU-CVE-2019-15132

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of...

PT-2019-12692

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine NetFlow Analyzer version 12.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands via the DeviceID parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint. Recommendations...

PT-2019-7894

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2 Description An issue was discovered in the software, where the apiKey parameter of the API endpoints "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a...