Lucene search
+L

169684 matches found

EUVD
EUVD
added 2026/08/24 3:31 a.m.5 views

EUVD-2026-64687

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

10CVSS8.6AI score
SaveExploits0References8
EUVD
EUVD
added 2026/08/24 3:31 a.m.4 views

EUVD-2026-64690

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

9.3CVSS8.5AI score
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 12:33 a.m.7 views

EUVD-2026-64673

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

6.9CVSS5.3AI score
SaveExploits0References7
BDU FSTEC
BDU FSTEC
added 2026/08/23 11:43 p.m.35 views

Blitz Identity Provider (Authentication server)

...

5.8AI score
SaveExploits0
NVD
NVD
added 2026/08/23 8:16 p.m.6 views

CVE-2026-19565

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

SaveExploits0References3
Cvelist
Cvelist
added 2026/08/23 7:18 p.m.16 views

CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

SaveExploits0References2
EUVD
EUVD
added 2026/08/23 7:18 p.m.9 views

EUVD-2026-64663

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...

5.6AI score
SaveExploits0References2
CVE
CVE
added 2026/08/23 7:18 p.m.11 views

CVE-2026-19565

Apache::AppSamurai::Util (Perl, versions through 1.01 ) contains a vulnerability in CreateSessionAuthKey that generates predictable session authentication keys. The function derives keys from Time::HiRes microsecond readings and the process ID , both of which have a small entropy space. Since Cre...

5.5AI score
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.48 views

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

5.4CVSS6.1AI score0.044EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.455 views

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

9.8CVSS8.8AI score0.17434EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.85 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypes&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

5.4CVSS5.6AI score0.00961EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.83 views

CandidATS 3.0.0 - Cross-Site Scripting

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6AI score0.01082EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.208 views

Tenda 11N - Authentication Bypass

Tenda 11N with firmware version V5.07.33cn contains an authentication bypass vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-42233 info: name: Tenda 11N -...

9.8CVSS9AI score0.42704EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.38 views

Elber ESE DVB-S/S2 - Authentication Bypass

Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system. id: CVE-2025-0674 info: name:...

9.8CVSS8.7AI score0.03583EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.139 views

Apache Druid - Server-Side Request Forgery

Server-Side Request Forgery SSRF, Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting', URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request tha...

5.8CVSS7.4AI score0.01726EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.83 views

WAVLINK - Access Control

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

7.5CVSS7.5AI score0.07552EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.121 views

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

10CVSS9.1AI score0.32337EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.42 views

Stop User Enumeration WordPress plugin - Authentication Bypass

Stop User Enumeration WordPress plugin 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding. id: CVE-2025-4302 info: name: Stop User Enumeration WordPre...

5.3CVSS7.9AI score0.00847EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.22 views

Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

9.8CVSS9.1AI score0.04499EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.292 views

MinIO Operator Console Authentication Bypass

MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. id: CVE-2021-41266 info: name: MinIO Operator...

9.8CVSS8.7AI score0.48414EPSS
SaveExploits1References5
Rows per page
Query Builder