CVE-2026-78387

RansomLook has an authorization weakness in its web-based configuration editor at the /admin/config endpoint. The route requires an authenticated session but performs no explicit privilege or administrator authorization check , allowing any authenticated low-privileged user to write crafted value...

CVE-2020-13945-EXPLOIT

CVE-2020-13945 - Apache APISIX Remote Code Execution RCE Questo repository contiene un proof-of-concept PoC per una vulnerabilità in Apache APISIX. La vulnerabilità si presenta quando l'Admin API è abilitata e le regole di restrizione degli IP di accesso vengono eliminate, consentendo al token...

CVE-2025-2266

🚨 CVE-2025-2266 — Exploit del plugin WordPress 🔍 Riepilogo della vulnerabilità Il plugin Checkout Mestres do WP for WooCommerce per WordPress è affetto da una vulnerabilità di aggiornamento arbitrario delle opzioni senza autenticazione nelle versioni 8.6.5 fino a 8.7.5. La funzione vulnerabile...

CVE-2026-78381 RansomLook Arbitrary File Read via Path Traversal in Post screen Field

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

Vehicle-Service-Management-System-Multiple-Privilege-Escalation-Leads-to-CRUD-Operations

CVE-2021-46075 Exploit-Titel: Vehicle Service Management System - 'Multiple' Privilege Escalation führt zu CRUD-Operationen Exploit-Autor: SANU P.L CVE: CVE-2021-46075 CVSS: 7.2 HIGH Referenzen:...

CVE-2023-32707

CVE-2023-32707 Un POC exploit migliorato basato sulla CVE segnalata su exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Panoramica Questo script consente di sfruttare una vulnerabilità in Splunk 9.0.5, portando all'acquisizione dell'account amministratore...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

EUVD-2026-64841

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 Ambiente di vulnerabilità CVE-2022-21661 Questo ambiente è configurato con il plugin Elementor Custom Skin per testare il CVE-2022-21661. per avviare l'ambiente console wp-lab$ ./start.sh Per ottenere la password di amministratore, recupera il log dal container in esecuzione; una...

Apache-APISIX-CVE-2022-24112

Exploit dell'esecuzione di codice remota di Apache APISIX CVE-2022-24112 Riepilogo Un attaccante può abusare del plugin batch-requests per inviare richieste al fine di aggirare la restrizione IP dell'Admin API. Una configurazione predefinita di Apache APISIX con chiave API predefinita è vulnerabi...

CVE-2026-6017

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-78246

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2019-11539

CVE-2019-11539 Scoperta originale: Orange Tsai, Meh Chang Autori: Justin Wagner, Alyssa Herrera Ringraziamenti a: Orange, Meh Chang, Rich Warren, Alyssa, Mimir Descrizione della vulnerabilità Nelle versioni di Pulse Secure Pulse Connect Secure 9.0RX precedenti alla 9.0R3.4, 8.3RX precedenti alla...

CVE-2025-57310

CVE-2025-57310 Eine Cross-Site Request Forgery CSRF-Schwachstelle in Salmen2/Simple-Faucet-Script v1.07 über eine manipulierte POST-Anfrage an admin.php?p=ads&c=1, die es Angreifern ermöglicht, beliebigen Code auszuführen. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Basis-Score: 8.8 Ho...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 Um ataque de execução remota de código RCE permite que um atacante execute código em um computador. A capacidade de executar código pode levar à implantação de malware adicional, roubo de dados sensíveis ou até mesmo danificar o servidor. A execução remota de código foi...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Unsicherer Passwort-Reset-Mechanismus → Vollständige Admin-Kontoübernahme Klartext-Passwort-Reset-Keys in der Datenbank gespeichert + SQL-Injection = Vollständige Admin-Übernahme 📋 Schwachstelleninformationen Verwandte CVEs gleiches Advisory CVE| Typ|...

EUVD-2026-64828

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246

A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 , specifically in the Admin Login component (file success/login.php). The root cause is the unsanitized handling of the Username argument, allowing an unauthenticated remote attacker to inject arbitrary SQL. ...