CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: autorizzazione mancante sugli endpoint dei plugin Docker → RCE sull'host Prova di concetto per CVE-2026-44848 , una vulnerabilità di autenticazione mancante CWE-862 in Portainer che consente a un utente non amministratore con accesso all'endpoint Docker di eseguire...

CVE-2026-75498

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75496

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...

CVE-2026-75498

Webkul QloApps is susceptible to SQL injection due to missing validation of request parameters before a database query. A remote attacker with administrative privileges can inject a crafted SQL query via the bo_query parameter in the Address.php file. The flaw allows high impact on confidentialit...

EUVD-2026-65588

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75497

Webkul QloApps is susceptible to a SQL injection vulnerability caused by insufficient validation of request parameters before a database query. A remote, authenticated attacker with administrative privileges can exploit the bo_query parameter in the CustomerMessage.php file to execute crafted SQL...

EUVD-2026-65585

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...

CVE-2022-44721-CsFalconUninstaller

CVE-2022-44721 Crowdstrike Falcon Disinstallatore CrowdStrike Falcon è una soluzione di endpoint detection and response EDR e antivirus AV basata su cloud. Su ogni dispositivo finale viene distribuito un sensore gestito a livello kernel che sfrutta le capacità cloud. Il sensore può essere...

CVE-2023-3460

CVE-2023-3460 Exploit für CVE-2023-3460 - Unauthorisierter Administratorzugriff für das Ultimate Member Plugin. PoC ist jetzt veröffentlicht. Es wurde nur zu Bildungs- und Forschungszwecken erstellt! Verwendung auf eigene Gefahr!...

400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

On August 11th, 2026, we received a submission for an Unauthenticated Account Takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for unauthenticated attackers to obtain an administrator's password reset...

audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

CVE-2020-14882-WebLogic-Analysis

Ricerca di vulnerabilità: Sfruttamento della catena CVE-2020-14882 e CVE-2020-14883 in Oracle WebLogic Server Il repository contiene un rapporto tecnico Write-up e un Proof of Concept PoC di livello concettuale per dimostrare la catena di vulnerabilità di bypass dell'autenticazione Authentication...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Molteplici XSS riflessi in TastyIgniter v3.0.7 Restaurtant CMS Nella dashboard di amministrazione di TastyIgniter versione 3.0.7 è presente una XSS riflessa autenticata. https://vulners.com/cve/CVE-2021-38699 POC: Parametro start della dashboard di amministrazione: root@kitploit:...

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79665

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...

BIT-KEYCLOAK-2026-37978 Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID userId parameter. This vulnerability allows for cross-role personally identifiable information PII leakage,...

BIT-KEYCLOAK-2026-2366 Keycloak: keycloak: information disclosure via authorization bypass in admin api

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim'...

moodle-login-csrf

Questo repository contiene i file utilizzati per scoprire e sfruttare due bug di moodle, MSA-18-0020 CVE-2018-16854 e MSA-19-0004 CVE-2019-3847, che sfruttano la capacità degli utenti di aggiungere JavaScript ai propri dashboard. MSA-18-0020 si basa su CSRF nel modulo di login, mentre MSA-19-0004...

BIT-KEYCLOAK-2026-14615 Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...