CVE-2026-111349

Craftplan versions through 0.7.5 are vulnerable to a missing authorization flaw within the CRM Customer resource. This vulnerability allows unauthenticated attackers to perform unauthorized actions by sending anonymous requests to the POST /api/json/customers endpoint or utilizing the create_cust...

PT-2026-115293

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create customer mutation to inser...

Vulnerabilities hidden in Ahsay AhsayCBS

Ahsay has fixed vulnerabilities in AhsayCBS up to version 10.3.2. The vulnerability with identifier CVE-2026-105133 has a CVSS score of 7.3 and involves insufficient authentication in the checkSysPwd function of the AhsayCBS API. An unauthorized malicious actor could exploit this vulnerability to...

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

EUVD-2026-95027

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

PT-2026-107999

Name of the Vulnerable Software and Affected Versions Integrics Enswitch versions 3.13 through 4.4 Description An authentication bypass exists in the '/api/json/user/password/update/' endpoint. Unauthenticated attackers can change account passwords by omitting the reset parameter. This occurs...

CVE-2026-107640: Weak Password Recovery Mechanism for Forgotten Password

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch...

EUVD-2026-92078

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack...

CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch...

Gitlab -- vulnerabilities

Gitlab reports: Improper Access Control issue in Group SAML Identity API impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE Denial of Service issue in Grape API JSON parsing middleware impacts GitLab CE/EE HTML injection issue in certain group setting fields...

scramble - Remote Code Execution

Exploit Title: scramble - Remote Code Execution Google Dork: inurl:/docs/api.json "dedoc/scramble" Date: 2026-05-07 Exploit Author: Joshua van der Poll https://github.com/joshuavanderpoll Vendor Homepage: https://scramble.dedoc.co Software Link: https://github.com/dedoc/scramble Version: =0.13.2,...

Malicious code in nodeapi-json (npm)

The package nodeapi-json was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adf38cc7ff9fedd8e0e5018c03c9141360823a8c5143181264185160ee040728 Any computer that has this package installed or running should be considered fully...

CVE-2025-55156: Improper Neutralization of Special Elements used in an SQL Command

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter addlinks in API /json/addpackage is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched ...

Exploit for Command Injection in Zohocorp Manageengine_Admanager_Plus

CVE-2023-29084 Command injection in ManageEngine ADManager Plu...

PT-2022-10477

Name of the Vulnerable Software and Affected Versions Foreman project affected versions not specified Description A flaw was found in the Foreman project, where a credential leak exposes the Azure Compute Profile password through JSON of the API output. The highest threat from this issue is to da...