CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

py3webfuzz

Py3webFuzz ';-- مكتبة وحدة فحص الويب بلغة بايثون متوافق مع وحدة بايثون 3 المؤلف Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz المساهمون Nathan Hamiel @nathanhamiel الوصف بناءً على pywebfuzz، فإن Py3webfuzz هي وحدة بايثون 3 للمساعدة في تحديد الثغرات الأمنية في تطبيقات...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — Accesso API non autenticato in lettura/scrittura di CyberPanel AI Scanner Template di rilevamento Nuclei per CVE-2026-41473 che interessa le versioni di CyberPanel precedenti alla 2.4.4. Vulnerabilità La funzionalità AI Scanner di CyberPanel espone due endpoint API senza...

CVE-2025-24893-XWiki-RCE

📜 Beschreibung In XWiki besteht eine kritische RCE-Sicherheitslücke , die es nicht authentifizierten Angreifern ermöglicht, über verwundbare API-Endpunkte beliebige Systembefehle auszuführen. Die Ausnutzung kann zu Folgendem führen: Vollständige Serverübernahme Datendiebstahl oder -vernichtung...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server وData Center - ثغرة حقن أوامر CVE-2022-36804 في الإصدارات المتأثرة من Atlassian Bitbucket Server وData Center، توجد ثغرة حقن أوامر في نقاط نهاية API متعددة حيث يمكن للمهاجم الذي لديه وصول إلى مستودع عام أو صلاحيات قراءة لمستودع Bitbucket خاص تنفيذ كود...

CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Aviso: Esta ferramenta é destinada apenas para fins educacionais e testes de penetração autorizados. Use-a apenas contra sistemas que você possui ou para os quais tenha permissão explícita por escrito para testar. O uso não autorizado é ilegal. Índice Visão Geral...

API-s-for-OSINT

API per OSINT root@kitploit: Questa è una raccolta di API utili per automatizzare vari compiti in OSINT. Istruzioni per principianti assoluti: Automazione OSINT: utilizzo di funzioni personalizzate per lavorare con richieste API in Google Sheets Grazie per avermi seguito! https://cybdetective.com...

CVE-2023-23752-poc

Betroffene Versionen 4.0.0 = 4.2.8 Joomla 3 und alle früheren Versionen sind von dieser Schwachstelle nicht betroffen. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true Diese API wird verwendet, um die wichtigsten Konfigurationsinformationen der Website abzurufen,...

cve-2022-36804

CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server In mehreren API-Endpunkten des Atlassian Bitbucket Server und Data Center wurde eine kritische Command-Injection-Schwachstelle gefunden. Diese Schwachstelle betrifft alle Versionen von Bitbucket Server und Data Center, die vor den Version...

CVE-2026-35616-detector.py

CVE-2026-35616 – Schwachstellenerkennung für FortiClient EMS Beschreibung Dieses Tool erkennt, ob ein FortiClient-EMS-Server anfällig für CVE-2026-35616 ist, eine kritische Schwachstelle durch unsachgemäße Zugriffskontrolle, die die Versionen 7.4.5 bis 7.4.6 betrifft. CVSS-Score: 9.1 Kritisch CWE...

CVE-2026-35616

CVE-2026-35616 — FortiClient EMS प्री-ऑथ बाईपास FortiClient एंडपॉइंट मैनेजमेंट सर्वर प्रमाणीकरण बाईपास CVE-2026-35616 के लिए प्रूफ ऑफ कॉन्सेप्ट PoC यह स्क्रिप्ट FortiClient EMS में एक प्रमाणीकरण बाईपास भेद्यता का शोषण करती है जो संरक्षित API एंडपॉइंट्स तक बिना प्रमाणीकरण के पहुंच की अनुमति देती ह...

halo-cors-csrf-CVE-2026-67921

CVE-2026-67921: Halo CMS CORS-Fehlkonfiguration + CSRF-Schutz-Umgehung – Kombinierter Angriff Zusammenfassung Eine kritische kombinierte Angriffsschwachstelle existiert in Halo CMS bis Version 2.25.4 aufgrund von zwei Sicherheitsfehlkonfigurationen: 1. CORS-Fehlkonfiguration : Die CORS-Richtlinie...

rewerse-engineering

rewerse engineering Dieses Repository zielt darauf ab, alle öffentlich zugänglichen nicht authentifizierten API-Endpunkte der Rewe-App zu implementieren, mit denen aktuelle Rabatte, Produkte, Rezepte und Rückrufe abgefragt werden können. Aktuell unterstützte APK-Version: 5.15.2 Stand: 12.07.26...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 एक प्रमाणीकरण बाईपास है जिसके परिणामस्वरूप Joomla! सर्वरों पर सूचना रिसाव होता है। हालांकि NVD द्वारा इसे CVSSv3 5.3 मध्यम गंभीरता के रूप में रेट किया गया है, यह कमजोरी सही परिस्थितियों में एक हमलावर को कोड निष्पादन प्राप्त करने की अनुमति दे सकती है। यह संभवतः हमलावर...