Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

Ricognizione e Sfruttamento: Vulnerabilità del Server HTTP Apache - CVE-2021-41773 e CVE-2021-42013 In questo progetto, ho documentato un processo dettagliato di penetration testing mirato alle vulnerabilità del server HTTP Apache, in particolare CVE-2021-41773 e CVE-2021-42013, che coinvolgono...

CVE-2025-34077

CVE-2025-34077 Dirottamento di sessione admin non autenticato - Plugin Pie Register ≤ 3.7.1.4 📌 Descrizione Questo exploit sfrutta una vulnerabilità nel plugin Pie Register per WordPress versioni ≤ 3.7.1.4, consentendo il dirottamento di sessione non autenticato di account admin. 🛡️ Questo...

CVE-2024-57778

CVE-2024-57778 Descrizione : Un problema in Orbe ONetView Roteador Onet-1200 consente a un attaccante remoto di aumentare i propri privilegi tramite la risposta del server, portando il codice di stato da 500 a 200. Versioni : Individuato in Orbe ONetView Roteador Onet-1200 Orbe 1680210096, ma...

CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Bypass dell'autenticazione di Gitea ≤1.26.2 1. Cos'è Gitea? Gitea è una piattaforma di hosting Git leggera e open-source che consente a organizzazioni e sviluppatori di gestire repository di codice sorgente, tracciare issue, revisionare le modifiche e collaborare su progetti...

CVE-2024-54363-Exploit

CVE-2024-54363-Exploit Fehlerhafte Zuweisung von Berechtigungen in nssTheme Wp NssUser Register ermöglicht eine Privilegienausweitung. Dieses Problem betrifft Wp NssUser Register: von n/a bis 1.0.0. Beschreibung Das Plugin nssTheme Wp NssUser Register für WordPress ist anfällig für ein Problem mi...

CVE-2025-68860

CVE-2025-68860 Il plugin WordPress Mobile builder La vulnerabilità Authentication Bypass Using an Alternate Path or Channel in Mobile Builder consente l'abuso dell'autenticazione. Questo problema riguarda Mobile builder da n/a fino alla 1.4.2. Punteggio CVSS: 9.8 CRITICO Vettore:...

Linux Distros Unpatched Vulnerability : CVE-2026-77648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from t...

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

EUVD-2026-41148

Wagtail: Improper permission handling in image preview...

GHSA-R6P4-GRQ7-XM4M Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

EUVD-2026-41147

Wagtail: Improper restriction handling on Documents and Images chosen endpoints...

PT-2026-79269

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import filtering opts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and ...

CVE-2026-18681 This Power System Buffer Overflow

IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute...

CVE-2025-14600

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

EUVD-2025-210742

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

PT-2026-78331

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

EUVD-2026-61130

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...