EUVD-2026-72585

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CVE-2022-40684

CVE-2022-40684 Утилиты для эксплуатации уязвимости CVE-2022-40684 FortiOS / FortiProxy / FortiSwitchManager - Обход аутентификации на административном интерфейсе...

CVE-2026-29519-Lucee-Reflected-XSS

CVE-2026-29519-Lucee-Reflected-XSS Lucee CFML における反射型 XSS の概念実証 CVE-2026-29519 フレームワーク 0-day: Lucee CFML の URL 解析における反射型 XSS がエンタープライズ環境に影響 バージョン 5.3.1.95 〜 7.x 発見者: Fouad Milat lavado 発見日: 2025年12月6日 CVE: CVE-2026-29519 ベンダー: Lucee Association 製品: Lucee CFML Server 影響を受けるバージョン: 5.3.1.95 から...

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE 제작: infrar3d 이것은 Krayin CRM v2.2.x오픈 소스 고객 관계 관리 시스템를 위해 특별히 설계된 원격 코드 실행RCE 개념 증명입니다. 이 스크립트는 CRM 관리 인터페이스의 파일 업로드 취약점을 자동으로 악용하여 대상 서버에서 원격 명령 실행을 달성합니다. Usage: root@kitploit: python3 CVE-2026-38526.py --help usage: CVE-2026-38526.py -h -rh RHOST -u USERNAME -p...

CVE-2026-54348

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:25+00:00| published-proof-of-concept| https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4 2026-08-19 13:32:06+00:00| seen| https://gist.github.com/alon710/af2c8d3762565eaa4715277e9dc15159...

keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

EUVD-2026-54517

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-18201

Keycloak-services: The Red Hat KB describes a vulnerability in Keycloak’s administrative API where an administrator who can manage identity providers can bind a new provider to an organization without having permissions to manage that organization, potentially influencing how users log in to that...

CVE-2026-29519

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

PT-2026-57164

Name of the Vulnerable Software and Affected Versions Lucee CFML Server versions 5.3.x Lucee CFML Server versions 6.1.x Lucee CFML Server versions 6.2.x Lucee CFML Server versions 7.0.x Description Reflected cross-site scripting occurs during URL path parsing, allowing unauthenticated remote...

CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

EUVD-2026-42496

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's...

PT-2026-56023

Name of the Vulnerable Software and Affected Versions ajenti versions prior to 2.2.14 Description The browser-facing login and administrative UI contains a clickjacking weakness. This occurs because the core HTTP response path in ajenti-core/aj/http.py initializes an empty header list and finaliz...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

PT-2026-48820

Improper verification of access permissions when modifying permissions through the Administration Control Panel ACP allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface...

CVE-2026-11986 Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

PT-2026-47622

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2 Description The web UI lacks Cross-Site Request Forgery CSRF protection on all /ui/ routes using POST, PUT, PATCH, or DELETE methods. The application processes requests immediately upon session cookie...

CVE-2026-40529

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface...

CVE-2026-5509

The CVE-2026-5509 entry describes an authenticated command-injection flaw in TP-Link Archer BE450 v1 and BE7200 v1 routers. After logging into the admin web interface, an attacker can inject crafted input via the browser’s developer console that is passed to backend system commands without suffic...

Authorization Bypass

9router is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization handling in the Administrative API endpoint /api, which allows an attacker to bypass access controls and perform unauthorized actions remotely...