2643 matches found
CVE-2009-1802
Multiple cross-site request forgery CSRF vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact...
CVE-2025-47785 EMLOG SQL Injection Vulnerability
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articlesave.php is not strictly filtered. Since admin/articlesave.php can be accessed by ordinary registered users, this will cause SQL injectio...
CVE-2025-2776
SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...
PLANET WGS-804HPT和PLANET WGS-4215-8T2S 访问控制错误漏洞
PLANET WGS-804HPT and PLANET WGS-4215-8T2S are both products of PLANET China.PLANET WGS-804HPT is an innovative industrial-grade 8-port 10/100/1000T wall-mounted managed switch.PLANET WGS-4215-8T2S is an innovative industrial-grade PLANET WGS-4215-8T2S is an innovative industrial grade 8-port...
Exploit for CVE-2025-3102
CVE-2025-3102 🛠️ SureTriggers Exploit Script Script ini diguna...
Exploit for Code Injection in Webkul Krayin_Crm
CVE-2025-3568 Privilege Escalation via Malicious SVG File...
GeoVision GV-ASManager 6.1.1.0 - CSRF
Exploit Title: GeoVision GV-ASManager 6.1.1.0 - CSRF Google Dork: inurl:"ASWeb/Login" Date: 02-FEB-2025 Exploit Author: Giorgi Dograshvili DRAGOWN Vendor Homepage: https://www.geovision.com.tw/ Software Link: https://www.geovision.com.tw/download/product/ Version: 6.1.1.0 or less Tested on: Windo...
CVE-2025-3102
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...
CVE-2025-3102 SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...
Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover Shodan Dork: html:"expedition project" FOFA Dork: "expedition project" && iconhash="1499876150" Exploit Author: ByteHunter Email: [email protected] Vulnerable Versions: 1.2 1.2.92 Tested on: 1.2.90.1 & 1.2.75 CVE ...
CVE-2025-2538
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...
CVE-2025-2538
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...
CVE-2025-2538 BUG-000174336
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...
CVE-2025-2538 BUG-000174336
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...
CVE-2025-2538
CVE-2025-2538 concerns a hardcoded credentials vulnerability in Esri Portal for ArcGIS, affecting deployments in Esri Portal for ArcGIS versions 11.4 and below. The issue enables a remote unauthenticated attacker to gain administrative access to the system via a hardcoded credential pattern in a ...
CVE-2024-8017
An XSS vulnerability exists in open-webui/open-webui versions = 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their ow...
CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...
CVE-2024-11638 Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user such as admin cookies by making them open a crafted URL as the request made to analysed the URL contain...
CVE-2024-11638 Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user such as admin cookies by making them open a crafted URL as the request made to analysed the URL contain...
PT-2025-9700 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 6.7.0 Description: The issue allows for path traversal, which may enable remote code execution using a privileged account, requiring a device admin account. This cannot be performed by a regular user. In combinatio...