185587 matches found
anviz-m3-rfid-cve-2019-11523-poc
Anviz M3 RFID Access Control security issues Security issues have been found in the Anviz M3 RFID Access Control device when working in standalone mode connected to a TCP/IP network, that could lead to access control bypass and private informations leakage and alteration. Advisory information...
CVE-2025-29927
CVE-2025-29927 Next.Js permission bypass vulnerability CVE-2025-29927 More PoCs at https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X path default /, multi-thread default 10 Batch detection: python poc.py -f url.txt -p /path -t 10 Single detection: python poc.py -u your-ip -p /path -t 10...
CVE-2025-68723
CVE-2025-68723: Axigen WebAdmin Stored XSS Vulnerability Summary Multiple input fields within the Axigen WebAdmin interface lack proper sanitization, allowing for the execution of malicious JavaScript. These vulnerabilities enable a low-privileged administrator or an attacker leveraging Broken...
CVE-2021-42671
CVE-2021-42671 CVE-2021-42671 - Broken access control vulnerability in the Engineers online portal system. Technical description: A broken access control vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to bypass access controls and get his...
CVE-2025-68721
CVE-2025-68721: Axigen WebAdmin Broken Access Control Vulnerability Summary A flaw in the permission logic allows an administrator account with zero permissions to access the "Security & Filtering" page, specifically the SSL Certificates endpoint. While other restricted sections are correctly...
CVE-2025-29556
CVE-2025-29556 – ExaGrid Security Officer Account Creation Bypass 📝 Overview Vulnerability Title : Unauthorized Creation of Security Officer Account Product : ExaGrid EX10 Backup Appliance Version Affected : Tested on current version at disclosure Versions Affected : 6.3 – 7.0.1.P08 CVE ID :...
CVE-2022-31813
Launch the Range docker compose up --build Normal Access GET / HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/145.0.0.0 Safari/537.36 Accept:...
cve-2019-14326
CVEID : CVE-2019-14326 Name of the affected products and versions : Andy all versions up to 46.11.113 Problem type : CWE-284: Improper Access Control Summary Andy is an Android emulator for Windows and Mac. During our tests, we have found open local TCP ports which could be exploited to escalate...
CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass
CVE-2025-46018 – CSC Pay Mobile App Payment Authentication Bypass Summary A payment authentication bypass vulnerability was discovered in the CSC Pay Mobile App, affecting version 2.19.4. The flaw allowed an attacker to initiate a payment, disable Bluetooth at a specific point in the process, and...
CVE-2025-52289
CVE-2025-52289: Broken Access Control in MagnusBilling v7.8.5.3 Description A Broken Access Control vulnerability exists in MagnusBilling versions prior to v7.8.5.3. Newly registered users can escalate their account status from pending to active without administrator approval by modifying a reque...
CVE
CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken access control...
CVE-2023-22515
CVE-2023-22515 CVE-2023-22515 Confluence Broken Access Control Exploit Vulnerability Description Confluence Unauthorized Addition of Admin User USAGE Build Source compilation go mod init CVE-2023-22515 go mod tidy go build -ldflags="-s -w" -trimpath -o CVE-2023-22515.exe .\CVE-2023-22515.go Run...
CVE-2025-27520-PoC
CVE-2025-27520 — Safe Educational Simulation / PoC Demo Stand ⚠️ Important: This is a safe educational simulation of the CVE-2025-27520 vulnerability. The project includes a simulation service Flask and a safe PoC scanner Python. On receiving a test marker, the simulation creates an evidence file...
CVE-2026-8347
CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...
CVE-2021-42913
CVE-2021-42913 Samsung Printer SCX-6X55X Improper Access Control Samsung Printer SCX-6x55X Series SyncThru Web Service is affected by an improper access control vulnerability. The vulnerability can permit an attacker to gain access to a list of SMB users and passwords...
CVE-2024-50657
CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...
CVE-2023-31704
CVE-2023-31704 description Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role. Vulnerability Type Incorrect Access Control Vendor of Product Sourcecodster Affected Product...
CVE-2025-25617
CVE-2025-25617 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to create syllabus entries — a role intended only for administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint:...
CVE-2023-31594
CVE-2023-31594 IC Realtime ICIP-P2012T is vulnerable to Incorrect Access Control Unauthenticated Streaming Channel in IC Realtime IP PTZ Dome Camera ICIP-P2012 software version: 2.420 The live feed MJPEG can be streamed via an exposed HTTP channel using VLC network stream. This vulnerability...
