CVE-2025-65669

CVE-2025-65669 Se descubrió un problema en classroomio 0.1.13. Las cuentas de estudiantes pueden eliminar cursos desde la página Explorar sin ninguna comprobación de autorización o autenticación, omitiendo la restricción de eliminación exclusiva para administradores que se esperaba. Descubierto...

cerbos

What is Cerbos? Cerbos is an authorization layer that evolves with your product. It enables you to define powerful, context-aware access control rules for your application resources in simple, intuitive YAML policies; managed and deployed via your Git-ops infrastructure. It provides highly...

casbin

Apache Casbin News : still worry about how to write the correct Apache Casbin policy? Apache Casbin online editor is coming to help! Try it at: https://casbin.apache.org/editor/ Apache Casbin is a powerful and efficient open-source access control library for Golang projects. It provides support f...

CVE-2022-26629

Lock Screen Bypass CVE-2022-26629 Affected Products SoroushPlus+ Messenger 1.0.30 Vulnerability Type Improper Access Control Impact Lock Screen Bypass Summary Improper handling of insufficient permissions and privileges allows an attacker to modify and overwrite the lock screen functionality...

CVE-2023-46501

CVE-2023-46501 - BoltWire v6.03 - Improper Access Control Description In version 6.03 of BoltWire CMS , it is possible to exploit an “Improper Access Control” vulnerability, through the index.php?p=member.admin&action=data parameter, allowing an attacker to view any member's password, including t...

CVE-2020-13277

CVE-2020-13277 CVE-2020-13277 Lab: GitLab Logic Vulnerability - Unauthorized User Access to Private Repositories 0x10 Lab Environment 0x20 Directory Structure CVE-2020-13277 ├── README.md ............... This README file ├── imgs .................... Images for README ├── gitlab...

h2csmuggler

h2cSmuggler Descripción h2cSmuggler introduce tráfico HTTP en configuraciones inseguras de proxypass de servidores periféricos estableciendo comunicaciones HTTP/2 en texto claro h2c con servidores back-end compatibles con h2c, lo que permite eludir reglas de proxy y controles de acceso. Consulte ...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

packetfence

PacketFence What is PacketFence? PacketFence is a fully supported, trusted, Free and Open Source network access control NAC system. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2...

CVE-2022-22828

CVE-2022-22828 Synametrics - SynaMan version 4.9 Summary Viden Labs has found an Insecure Direct Object Reference IDOR vulnerability in Synametric's SynaMan. This vulnerability is present in versions 4.9 and earlier. This vulnerability has since been patched in version 5.0. “Insecure direct objec...

rbac

PHP-RBAC v2.x PHP-RBAC is an authorization library for PHP. It provides developers with NIST Level 2 Hierarchical Role Based Access Control and more, in the fastest implementation yet. Current Stable Release: PHP-RBAC v2.0 Connect With Us Home Page: http://phprbac.net/ OWASP Project Page:...

DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

DynamiApps Frontend Admin plugin for WordPress .= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data. id:...

Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...

Lin CMS Spring Boot - Default JWT Token

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application. id: CVE-2022-32430 info: name: Lin CMS Spring Boot - Default JWT Token author: DhiyaneshDK severity: high description: | An access control issue in Lin CM...

WAVLINK - Access Control

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

Dify v1.9.1 - Broken Access Control

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

Webnus Inc. Modern Events Calendar - Broken Access Control

Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. id: CVE-2026-32583 info: name: Webnus Inc. Modern Events...

WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation

MemberGlut WordPress plugin 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication. id: CVE-2026-12394 info:...