CVE-2022-22828

CVE-2022-22828 Synametrics - SynaMan 版本 4.9 摘要 Viden Labs 在 Synametrics 的 SynaMan 中发现了一个不安全的直接对象引用（IDOR）漏洞。该漏洞存在于 4.9 及更早版本中。 该漏洞已在 5.0 版本中修复。 “不安全的直接对象引用（IDOR）是一种访问控制漏洞，当应用程序使用用户提供的输入直接访问对象时就会出现这种漏洞。” - https://portswigger.net/web-security/access-control/idor。 利用该漏洞，可以访问 SynaMan...

CVE-2025-25968

CVE-2025-25968：DDSN Interactive cm3 Acora CMS 10.1.1 版本中的访问控制不当漏洞 DDSN Interactive cm3 Acora CMS 10.1.1 版本存在访问控制不当漏洞。具有编辑者权限的用户可通过强制浏览端点并利用“file”参数，访问敏感信息（如系统管理员凭据）。通过引用特定文件（例如 cm3.xml），攻击者可绕过访问控制，进而导致账户接管和潜在的权限提升。 受影响版本：Acora CMS v10.1.1 由 Crowe India 的 Joby Y Daniel 发现。...

CVE-2020-11539

CVE-2020-11539：Tata Sonata 智能手环存在不当访问控制 信息 描述： 已识别出该智能手环没有配对（BLE 安全级别模式 0），空中传输的数据未加密。此外，发送到智能手环的数据没有任何身份验证或签名验证，使得任何攻击者都能控制智能设备的参数。 影响版本： Smart SF Rush - 1.12 研究人员： Sayli Ambure https://twitter.com/sayliambure MITRE CVE 链接： https://vulners.com/cve/CVE-2020-11539 概念验证漏洞利用 描述...

Linux Distros Unpatched Vulnerability : CVE-2026-102795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3...

CVE-2020-14064

Icewarp Email Server 12.3.0.1 不正确的访问控制 https://nvd.nist.gov/vuln/detail/CVE-2020-14064...

adminer_CVE-2021-43008

CVE-2021-43008 — Adminer 漏洞 通过恶意 MySQL 服务器进行任意文件读取 1. 什么是 Adminer？ Adminer 是一个网页工具（PHP），用于轻松管理 MySQL、PostgreSQL、SQLite 或 SQL Server 数据库。 它通常作为 phpMyAdmin 的轻量级替代方案部署。 受影响版本：Adminer ≤ 4.6.2 2. 漏洞的本质是什么？ 2.1. 访问控制缺陷 Adminer 允许连接到任何远程 MySQL 服务器 。 然而，在连接到 MySQL 服务器时，客户端（此处为 Adminer）会接受： 服务器发送的一组初始指令，...

CVE-2026-37070

CVE-2026-37070 位于 Veno File Manager Project 4.4.9 中的 /vfm-admin/ajax/streamvid.php 存在不正确的访问控制，允许已认证的攻击者通过向受影响端点发送特制的 GET 请求，在知道路径和文件名的情况下读取其他用户上传的任何文件。 https://github.com/user-attachments/assets/f5d44ead-af30-4c88-8e90-ad1e1e4913b5...

CVE-2026-37073

CVE-2026-37073 Veno File Manager Project 4.4.9 中的 /vfm-admin/ajax/sendfiles.php 存在不正确的访问控制，允许未经身份验证的攻击者通过向该端点发送带有所需参数和请求头的 POST 请求，从应用程序配置的 SMPT 服务器发送电子邮件。...

Access Control Bypass

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolated plugin worker...

DEBIAN-CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

UBUNTU-CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Apache Traffic Server is affected by an Improper Access Control vulnerability due to the SNI to Host header matching policy not being properly enforced. This issue impacts versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 . To remediate this vulnerability, users are recommended to upgrade t...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

EUVD-2026-91766

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

VertXploit

VertXploit 利用 HID VertX 和 EDGE 门禁控制系统 摘要 VertXploit 是一款可用于利用 HID VertX 和 EDGE 门禁控制系统的工具。 discoveryd 服务中存在一个漏洞，该服务在执行系统调用前未能对用户数据进行过滤。这允许在无需身份验证的情况下，在 HID VertX 和 EDGE 门禁控制系统上执行任意代码。有关更多信息，请参阅命令注入部分。 VertXploit 可以解锁或锁定连接到门禁控制系统的门，下载包含所有已配置/缓存门禁卡信息的数据库，并且如果 VertX 系统存在漏洞，还可以以 root 身份执行任意命令。 如果 VertX...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...