CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

vcenter_saml_login

Strumento di Accesso SAML per vCenter Uno strumento per estrarre il certificato dell'Identity Provider IdP dai backup di vCenter e accedere come Administrator Contesto Comunemente, durante gli engagement, otteniamo accesso ai backup di vCenter su un file server o accesso root all'host VCSA tramit...

vRealizeLogInsightRCE

VMSA-2023-0001 POC für VMSA-2023-0001, der VMware vRealize Log Insight betrifft und die folgenden CVEs enthält: Sicherheitslücke bezüglich Directory Traversal in VMware vRealize Log Insight CVE-2022-31706 Sicherheitslücke in der Zugriffskontrolle von VMware vRealize Log Insight CVE-2022-31704...

CVE-2026-18886

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

EUVD-2026-67234

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2025-20362-Cisco-Scanner

CVE-2025-20362 Scanner Ein sicherer, nicht-destruktiver Python-Scanner für Cisco ASA / FTD WebVPN Authentifizierungsumgehung CVE-2025-20362. CVE-2025-20362 ermöglicht nicht authentifizierten Angreifern, die Authentifizierung zu umgehen und auf eingeschränkte WebVPN-Ressourcen durch...

CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

EUVD-2026-67230

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-77438

Trilium (open-source hierarchical note-taking app), in versions up to and including 0.103.0 , has an authorization flaw in its public share-search endpoint . The endpoint authorizes only the ancestor note supplied in the request, then performs a full-text search across the entire published subtre...

CVE-2026-50751-Mitigation-Scripts

CVE-2026-50751-Mitigation-Scripts Es gibt mehrere Sicherungsmaßnahmen, die Sie aus der SK verwenden können; https://support.checkpoint.com/results/sk/sk185033 1. Deaktivieren Sie die Unterstützung für Legacy-Clients. 2. Konfigurieren Sie den Remotezugriff so, dass nur IKE v2 verwendet wird. Es gi...

CcmMessagingBackdoor

CcmMessagingBackdoor Strumenti proof of concept per creare e installare un servizio CcmMessaging non autorizzato per mantenere l'accesso a un Management Point Utilizzo Compilare e installare il servizio COM non autorizzato sul Management Point root@kitploit: Compile PS C:...

WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...

WordPress LiteSpeed Cache plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes vulnerability

Authenticated Author+ Stored Cross-Site Scripting via img Tag Attributes vulnerability discovered by stealthcopter in WordPress Plugin LiteSpeed Cache versions = 7.7...

samba-trans2open-exploit-report

Report dell'Exploit Samba Trans2Open Questo repository contiene una guida tecnica completa per sfruttare la vulnerabilità Samba Trans2Open CVE-2003-0201 in un ambiente Linux virtuale. Lo sfruttamento è stato effettuato a scopo educativo e di formazione sull'hacking etico. Contenuti del Report...

Security Bulletin: Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-7362)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. Vulnerability Details CVEID:CVE-2026-7362 DESCRIPTION: IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and...

CVE-2026-74820

CVE-2026-74820 is a CRITICAL (CVSS 4.0: 10.0) SQL injection vulnerability in the ServiceNow AI platform , specifically through a Dynamic Schema ORDER BY clause . An unauthenticated user can, under certain circumstances, execute arbitrary SQL statements against the instance's underlying database, ...

CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

EUVD-2026-67221

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...