CVE-2025-59718-PoC

Wizard di Exploit CVE-2025-59718 Panoramica Questo strumento è uno script proof-of-concept PoC per CVE-2025-59718, una vulnerabilità critica di bypass dell'autenticazione nei prodotti Fortinet ad es. FortiOS, FortiProxy, FortiSwitchManager dovuta a una verifica impropria delle firme crittografich...

CVE-2026-78477

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

Palo Alto Expedition - Admin Account Takeover

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. id: CVE-2024-5910 info: name: Palo Alto Expedition - Admin Account Takeover author: johnk3r severity: critical...

Western Digital MyCloud NAS - Authentication Bypass

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Triofox - Improper Access Control

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. id: CVE-2019-18818 info: name: strapi CMS 3.0.0-beta.17.5 - Admin Password Reset...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

KubePi JwtSigKey - Admin Authentication Bypass

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Proof of Concept di Iniezione di Comandi Descrizione della vulnerabilità: Le funzioni ping e traceroute del router NETIS SYSTEMS WF2409E versione V3.6.42541 sono suscettibili ad attacchi di iniezione di comandi. Input malevoli possono esse...

CVE-2026-78477 Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

CVE-2025-47550

Instantio - Plugin Wordpress 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2026-45156-POC

Glitch Matrice Hacker 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me Bypass della Firma JWT Proof of Concept PoC completamente automatizzato per l'acquisizione dell'admin. 📖 La Storia Dietro ogni CVE c'è una storia. Questa è stata trovata alle 2 di notte in una fredda notte d'inverno, alimentata da...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection nel parametro sSortDir0 - v3.5.2 - v4.5.4. Oltre alla possibilità per un amministratore di sfruttare questa vulnerabilità, può essere utilizzata anche in un attacco CSRF per indurre un utente amministratore a eseguire query dannose. File interessati...

CVE-2023-44811

CVE-2023-44811 mooSocial v3.1.8 è vulnerabile a Cross Site Request Forgery CSRF che consente a un attaccante di cambiare la password dell'amministratore quando un utente amministratore autenticato fa clic sulla pagina HTML dannosa appositamente creata. Fornisco 2 pagine HTML che, quando viene fat...

cve-2026-9558-poc

CVE-2026-9558 — Iniezione di template lato server SSTI nei template dei temi di Mautic fino alla compromissione totale dell'admin Indice Panoramica Versioni interessate Causa principale Analisi Struttura del repository Requisiti Utilizzo Output previsto Riferimenti Avvertenze Panoramica...

CVE-2025-63820

CVE-2025-63820 Einreicher: Nicola Giuffrida Informationen Hersteller: TOTOLINK Website des Herstellers: TOTOLINK Modell: A720R Firmware-Version: V4.1.5cu.630B20250509 Firmware-Downloadadresse: TOTOLINK Details zur Schwachstelle Beim Anmelden am Kontrollpanel werden Benutzername und Passwort im...