CVE-2023-43148

CVE-2023-43148 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF DELETE ALL ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows ...

fortinet-cve-2024-46671

CVE-2024-46671 0-day vulnerability discovered in FortiWeb waf version 7.4.3 build 638GA Exploit Mainly this script automate the exploitation of an authenticated IDOR vulnerability leading to account delection & default account re-creation with no password due to a logical bug in fortiweb Exploit...

CVE-2025-25967

CVE-2025-25967: Cross-Site Request Forgery CSRF DDSN Interactive cm3 Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery CSRF. This flaw enables attackers to trick authenticated users into performing unauthorised actions, such as account deletion or user creation, by embedding...

CVE-2026-115255 WP Roster < 2.35 - Unauthenticated Roster Member Deletion

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members...

CVE-2026-115255

The WP Roster WordPress plugin (versions before 2.35 ) is vulnerable to an unauthenticated roster member deletion vulnerability. The flaw exists because the plugin fails to perform any capability or nonce checks on one of its AJAX actions . This allows an unauthenticated attacker to delete the Wo...

CVE-2026-86589

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

EUVD-2026-104164

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

CVE-2026-86589

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

PT-2026-117321

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

Malicious code in ukraine69 (PyPI)

Source: kam193 751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-17919 Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

CVE-2026-66078

A flaw was found in RabbitMQ. A remote authenticated user with administrative privileges can bypass account deletion safeguards by removing accounts using the bulk-delete API endpoint. Because this endpoint fails to check whether a user account has the protected tag, protected service accounts ca...

EUVD-2026-102469

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...

CVE-2026-111278 NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...

CVE-2026-111278

NivoCart versions through 2.5.1 are vulnerable to a CAPTCHA bypass vulnerability (CWE-804) because the expected CAPTCHA code is disclosed as plain text within the page HTML. This allows unauthenticated attackers to extract the captcha_image value using pattern matching, enabling them to bypass fo...

CVE-2026-111278 NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...

CVE-2026-111278 NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...

LingGuoAI LingGuo short drama authorization issue vulnerabilities

LingGuoAI short dramas have an authorization issue. This vulnerability stems from the fact that the /admin/v1/admins API is only protected by AuthAdminJWT, lacking proper authorization verification. Attackers can register themselves, read the bcrypt hash values of all accounts, reset the bootstra...

CVE-2026-111278: Guessable CAPTCHA

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...