EUVD-2026-65164

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

EUVD-2026-65165

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

EUVD-2026-65173

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

EUVD-2026-65160

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-74251

Nicht authentifizierte SQL-Injection über den Attributfilter in Phoca Cart Phoca Cart ≤ 6.1.6 — Nicht authentifizierter Angreifer extrahiert die vollständige Datenbank durch zeitbasierte Blind-Injection ZUSAMMENFASSUNG Die GET-Array-Parameter a Attribut und s Spezifikation der öffentlichen...

Vulnerable-Docker-Engine

CVE-2021-41091 Questo exploit offre un'analisi approfondita della vulnerabilità di sicurezza CVE-2021-41091 e fornisce una guida passo-passo su come utilizzare lo script di exploit per ottenere un'escalation dei privilegi su un host. Riepilogo della vulnerabilità CVE-2021-41091 è un difetto in Mo...

CVE-2024-36842-Backdooring-Oncord-Android-Sterio-

CVE-2024-36842 Backdooring su Stereo Android Oncord+ Abbiamo condotto una valutazione delle vulnerabilità su una delle unità di infotainment per auto aftermarket più vendute. Creazione di una backdoor persistente sull'unità di infotainment per auto Oncord+ Android/iOS utilizzando uno script...

CVE-2026-54415-PoC

CVE-2026-54415 — Azuriom CMS Fehlerhafte Zugriffskontrolle → Account-Übernahme Fehlende Autorisierung bei den Admin-Server-Verwaltungsrouten in Azuriom CMS 1.2.11 ermöglicht es jedem Administrator mit niedrigen Privilegien der nur admin.access besitzt, ein AzLink-Server-Token zu erstellen und jed...

PT-2026-81273

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-81484

Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...

CVE-2026-75465

An Incorrect Access Control vulnerability exists in the /api.php/user/get_list endpoint of Maccms v10 (version v2026.1000.4055 ). The endpoint performs no authentication or authorization checks, allowing an unauthenticated remote attacker to send a crafted HTTP GET request with limit and offset p...

CVE-2026-38470

CVE-2026-38470 is a broken access control vulnerability in the API user endpoint of GazellePW (GazellePosterWall) , specifically at commit 86c4bedf727691b5a97af42a4864869d18446449. An unprivileged, authenticated user holding a standard user-created API token can enable or disable arbitrary user a...

PT-2026-81188

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf form id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-81915

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.56.0 Description An issue exists where team-membership checks are not enforced in the voteOnAttribute function of TimesheetVoter. This function maps permissions only to own timesheet or other timesheet. Consequently,...

CVE-2026-38474

GazellePW (GazellePosterWall), a media management application, contains a Broken Access Control vulnerability in its IP lock manager . At commit 86c4bedf, the endpoint tools.php?action=iplock does not properly validate that the authenticated user owns the target account, allowing any remote authe...

PT-2026-81516

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw affected versions not specified Description NVIDIA NemoClaw for Linux contains a flaw in its inference server setup that allows a remote attacker to access the inference service without authentication. The issue occurs when the...

aws-key-disabler

AWS Lambda - Disabilitatore di Chiavi di Accesso IAM Il Disabilitatore di Chiavi AWS è una funzione Lambda che disabilita le chiavi di accesso degli utenti IAM AWS dopo un periodo di tempo prestabilito per ridurre il rischio associato alle chiavi di accesso obsolete. Architettura AWS Lambda Outpu...

aws-key-disabler

AWS Lambda - IAM Access Key Disabler The AWS Key disabler is a Lambda Function that disables AWS IAM User Access Keys after a set amount of time in order to reduce the risk associated with old access keys. AWS Lambda Architecture SysOps Output for EndUser Developer Toolchain Current Limitations A...

CVE-2025-30567

Introduzione Download Arbitrario di File Non Autorizzato in WordPress WP01! Preparazione dell'ambiente Passaggio 1: Scarica il plugin WP01, ma... Ahah, non preoccuparti, ecco il codice sorgente del plugin. Passaggio 2: Impacchetta la cartella wp01 fornita e caricala nella sezione plugin di...

cdt-vulnsamba-deploy

CDT Team Delta - Distribuzione Samba Vulnerabile Panoramica Questo repository è un deployment basato su Ansible di un server Samba vulnerabile affetto da CVE-2017-7494, una vulnerabilità critica di esecuzione remota di codice. Dovrebbe essere distribuito per il team Delta durante la fase Grey Tea...