CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

CVE-2025-67246

CVE-2025-67246 Vulnerability Title :LuDaShi Incorrect Access Control Affected versions :Less than 6.1026.4505.112 Discovery time :December 2, 2025 Discoverer :ZhouRui Analysis Report : LuDaShi is a well-known free system utility software that provides free hardware authentication, computer mobile...

CVE-2026-86206

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206

N-central (N-able) is affected by a vulnerability in its internal API access control filter that allows unauthorised access to internal APIs when the filter is bypassed. The flaw requires no privileges and no user interaction , is exploitable over the network with low complexity, and results in l...

EUVD-2026-72023

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2025-67070-Intelbras-CFTV-MFA-Bypass

Intelbras NVD 9032 R Ftd – 严重密码重置漏洞 发现者：Theo Cia CVE：CVE-2025-67070 状态：已报告给厂商 发现日期：2025年11月 影响：通过绕过 MFA 获得完全管理访问权限 固件：V2.800.00IB00C.0.T 构建日期：2022-08-17 概要 Intelbras NVD 9032 R Ftd IP CFTV 设备中存在一个严重漏洞，攻击者可在密码恢复过程中绕过多因素认证。这导致攻击者能够更改管理员密码并获得管理面板的完全访问权限。 漏洞详情 受影响组件：密码恢复端点 漏洞类型：访问控制不当 CWE-284 攻击途径：基于...

CVE-2021-42562

CVE-2021-42562: Improper Access Control in MITRE Caldera Caldera versions =2.8.1 does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components which should only be accessible by admin users. Vendor Disclosure: The...

HAProxy-CVE-2023-45539-PoC

HAProxy-CVE-2023-45539-PoC HAProxy 2.8.2 之前的版本接受 作为 URI 组件的一部分，这可能导致远程攻击者在 pathend 规则被错误解释时获取敏感信息或造成其他未明确的影响，例如将 index.html.png 路由到静态服务器。 此 CVE 中会被错误路由的并非后端应用“支持”的任何扩展名——而仅仅是 HAProxy 自身配置为使用 pathend（或正则）ACL 进行路由的那些扩展名。 root@kitploit: acl isstatic pathend .png .jpg .gif .css .js usebackend bestati...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Unauthenticated RCE SP Page Builder comsppagebuilder for Joomla ≤ 6.6.1 allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution. Field| Value ---|--- CVE| CVE-2026-48908 CWE| CWE-284 Improper Access Control Component| SP Page...

CVE-2025-65731

CVE-2025-65731 CWE-1191: 片上调试与测试接口访问控制不当 D-Link DIR-605L 上的 UART 根 Shell 访问漏洞（硬件 F1，固件 V6.02CN02） 概述 在 D-Link DIR-605L 路由器（硬件版本 F1，固件外部版本 V6.02CN02，运行 Linux 内核 2.4.18）中发现了一个严重的硬件安全漏洞。UART 调试接口缺乏适当的访问控制机制，任何拥有物理访问权限的攻击者均可连接到 UART 引脚，获取未经过身份验证的根 Shell 访问权限。此漏洞对应 CWE-1191：片上调试与测试接口访问控制不当。 受影响产品：...

CVE-2023-27350

CVE-2023-27350 This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 Build 63914. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper...

CVE-2024-25169-Mezzanine-v6.0.0

Product: Mezzanine CMS Version: v6.0.0 Date found: 10.01.2024. Date reported: 10.01.2024. Vulnerability type: Incorrect Access Control. CVE ID: CVE-2024-25169 Description: An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via crafted request. POC...

apache__jspwiki_CVE-2019-10076_2-11-0-M3

Apache JSPWiki 2.11 - Documentation root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

CVE-2024-30973

CVE-2024-30973 - V-SOL G/EPON ONU - HG323AC-B Description Item: root@kitploit: Item: G/EPON ONU Specification: HG323AC-B Device model XPON+2GE+1POTS+2WIFI+USB Device SN 70B64F-1234570B64F0C2C0C Hardware Version V1.0 Firmware Version V2.0.08-210715 PON S/N GPON000C2C0C Vulnerability...

CVE-2024-48955_Overview

CVE-2024-48955Overview Description: Netadmin 4 IAM with access control flaws. Affected version: V4.030319 NetAdmin system returns data with functionalities in the endpoint that "builds" the functionality menus; the response of this call is not encrypted, and as the system does not validate sessio...

CVE-2023-23752

Joomla! options Arguments...

CVE-2024-50967

CVE-2024-50967 DATAGERRY Broken Access Control This vulnerability affects DATAGERRY platform in all versions up to and including 2.2.0 ≤2.2.0...

CVE-2024-45058

CVE-2024-45058 PoC for CVE-2024-45058 Broken Access Control, allowing any user with view permission in the user configuration section to become an administrator changing their own user type. Grab the desired nivelusuario ID and run the exploit. Usage root@kitploit: usage: CVE-2024-45058.py -h -t...