148 matches found
CVE-2024-27631
CVE-2024-27631 漏洞详情 概述 在Savane v3.12及之前版本中，管理功能缺乏CSRF保护可能导致权限提升和/或帐户接管。特别是，端点/siteadmin/usergroup.php包含更改其他用户密码和管理标志的功能，实际上允许攻击者使自己成为管理员。 其他易受CSRF攻击的端点包括： /support/admin/userperms.php - 更改谁可以发布跟踪器的权限。 /project/admin/conf-copy.php - 用另一组的配置覆盖现有组的配置。 /project/admin/editgroupnotifications.php -...
CVE-2025-40554
CVE-2025-40554 利用套件 一个用于检测和利用 SolarWinds Web Help Desk 中认证绕过漏洞（CVE-2025-40554 / CVE-2025-40536）的综合安全测试工具。 ⚠️ 免责声明 仅供教育及授权安全测试使用 本工具仅用于对您拥有或已获得明确书面授权的系统进行安全研究、渗透测试和漏洞评估。未经授权访问计算机系统是违法的。作者不对因使用本工具造成的误用或损害负责。 🔍 漏洞概述 CVE-2025-40554 是 SolarWinds Web Help Desk 中的一个严重认证绕过漏洞，允许未认证的攻击者： 绕过认证机制 访问特权管理功能（认证）...
CVE-2026-10243-AUTH
Smart Parking System 1.0 - 未授权访问关键管理员功能 漏洞信息 字段| 详情 ---|--- 产品| Smart Parking System 厂商| code-projects.org 版本| 1.0 漏洞类别| 关键功能缺少身份验证（CWE-306） CVE ID| 待定 CVSS 评分| 9.8 严重（AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H） 所需身份验证| 无 受影响文件| attendant.php、edit.php、basictable.php、basictable2.php、adminrequest.php 描述...
PT-2026-83877
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...
PT-2026-82780
Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...
CVE-2026-27604 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/ endpoints. Because system resolves to the cron admin identity,...
CVE-2026-27604 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/ endpoints. Because system resolves to the cron admin identity,...
CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...
CVE-2026-42286
The CVE-2026-42286 entry concerns Emlog, an open source website building system. Affected versions prior to 2.6.11 lack CSRF protection in critical admin functions, enabling an attacker to coerce authenticated admins into actions such as system registration, plugin management, and configuration c...
CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...
CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...
CVE-2026-42286: Cross-Site Request Forgery (CSRF)
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...
DEBIAN-CVE-2026-41176
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and pri...
CVE-2026-40041
Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...
CVE-2026-40041
CVE-2026-40041 affects Pachno 1.0.6 and describes a cross-site request forgery (CSRF) vulnerability arising from missing CSRF protections on state-changing endpoints. Attackers can craft requests that execute actions in an authenticated user context via attacker-controlled sites, targeting login,...
EUVD-2026-12643
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...
CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...
CVE-2026-1364
CVE-2026-1364 affects IAQS and I6 developed by JNC, with a Missing Authentication vulnerability that allows unauthenticated remote attackers to directly operate system administrative functionalities. The issue is labeled as CRITICAL (CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/V C:H/I:H/A:H; base score 9...
PT-2026-4343
Name of the Vulnerable Software and Affected Versions IAQS and I6 affected versions not specified Description A missing authentication issue exists in IAQS and I6 developed by JNC. This allows unauthenticated remote attackers to directly operate system administrative functionalities...
