EUVD-2026-125603

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files witho...

EUVD-2026-125617

paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/articleId to retrieve full content of paid,...

EUVD-2026-125609

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, question...

EUVD-2026-125613

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and...

EUVD-2026-125615

SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a %...

EUVD-2026-125548

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which...

CVE-2026-124716

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0...

CVE-2026-124723

Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With matchuriencodedslash enabled and skipmtlsuriregex configured, a client without a certificate can reach an upstream behind a route that requires one, limited to request paths that decode to an exempted...

CVE-2026-129143

The paicoding 1.0.3 software contains a missing authorization vulnerability in the ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to bypass access controls and read restricted content by enumerating article IDs via the GET /article/api/data/detail/{artic...

CVE-2026-129151

SurveyKing version 1.13.2 is vulnerable to an unauthenticated survey response disclosure due to a missing authorization flaw in the result lookup functionality. The anonymous survey view leaks the lookup configuration, including the password, and fails to enforce a password check when no answer i...

CVE-2026-129153

SurveyKing versions 1.12.0 through 1.13.2 are vulnerable to an authorization bypass within the linked survey feature. The application fails to verify if the referenced linkSurveyId belongs to the caller's project. Consequently, an authenticated attacker can point a linked option at another user's...

CVE-2026-129157

The software ragent versions 1.0.0 through 1.1.0 contains a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. By navigating the /rag/traces/runs and related node endpoints, an at...

CVE-2026-129164

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an authorization bypass because share codes are only enforced on the client-side. Attackers who possess a share ID can directly call the share items and download endpoints to list and download files without providing the required code...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

CVE-2026-129131

Gameyfin versions prior to 2.6.2 are vulnerable to a missing authorization flaw in Hilla endpoints. The issue stems from the LiveSubscriptionSecurity component failing to check synchronous endpoint methods, such as GameEndpoint.sync , when they are annotated with @AnonymousAllowed . This allows u...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

cloudpanel-2.4.2-CVE-2024-44765-recovery

CVE-2024-44765 is an Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel versions 2.0.0 to 2.4.2 1. Follow instructions in every folder this should be done locally 2. Reset Passwords and Access for root $ sudo passwd root while for users $ getent...

Exploit-CVE-2023-22518

Exploit-CVE-2023-22518 CVE-2023-22518 in Confluence CVE-2023-22518: This vulnerability is described as “an improper authorization vulnerability in Confluence's database and server”. The issue affects On-premises versions of Atlassian products. Setup Environment Use the vulnerable version 8.0.4 UR...

DIR8xx_PoC

phpcgi phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a...