route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

CVE-2024-48955_Overview

CVE-2024-48955Descripción general Descripción: Netadmin 4 IAM con fallos de control de acceso. Versión afectada: V4.030319 El sistema NetAdmin devuelve los datos con las funcionalidades en el endpoint que "monta" los menús de funcionalidades, el retorno de esta llamada no está cifrado y como el...

CVE-2024-50967

CVE-2024-50967 DATAGERRY Control de Acceso Roto Esta vulnerabilidad afecta a la plataforma DATAGERRY en todas las versiones hasta e incluyendo la 2.2.0 ≤2.2.0...

CVE-2023-22515-Scan

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

golang-webmin-CVE-2022-0824-revshell

golang-webmin-CVE-2022-0824-revshell RCE en Webmin url objetivo c - credenciales para webmin sl - IP y puerto de tu servidor local para alojar tu payload s - IP de callback p - puerto de callback Referencias https://www.webmin.com/security.html...

CVE-2025-25616

CVE-2025-25616 Unifiedtransform v2.0 es vulnerable a un Control de Acceso Incorrecto, permitiendo a los estudiantes modificar las reglas de los exámenes. El endpoint afectado es /exams/edit-rule?examruleid=1. Vendor: Unifiedtransform PoC Paso 1: Inicie sesión en la aplicación como Estudiante. Pas...

CVE-2024-45058

CVE-2024-45058 PoC para CVE-2024-45058 Control de Acceso Roto, que permite a cualquier usuario con permiso de visualización en la sección de configuración de usuario convertirse en administrador cambiando su propio tipo de usuario. Toma el ID de nivelusuario deseado y ejecuta el exploit. Uso...

CVE-2019-13403

CVE-2019-13403 Informe: Mayo 2019 Solución: Mayo 2019 Crédito: B3Bo1d Descripción Temenos CWX versión 8.9 tiene una vulnerabilidad de Control de Acceso Roto en el módulo /CWX/Employee/EmployeeEdit2.aspx, lo que lleva a la visualización de información del usuario. PoC Antes Después Referencia...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 es vulnerable a un Control de Acceso Incorrecto, lo que permite a los profesores tomar asistencia de otros profesores a través del endpoint /courses/teacher/index?teacherid=2&semesterid=1. Vendor: Unifiedtransform PoC Paso 1: Inicie sesión en la aplicación com...

EUVD-2026-76868

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...

EUVD-2026-76866

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly...

CVE-2026-90546

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the like.json.php endpoint. The application fails to validate video access permissions before processing like requests, allowing any logged-in user to submit likes on password-protected an...

EUVD-2026-76862

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting...

CVE-2026-90533

Flowise before 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. Any authenticated organization member can query the endpoint with an arbitrary user ID to retrieve the organization owner's full user record, including the bcrypt password hash ...

EUVD-2026-76851

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-27344

Broken Access Control in Inseri Core WordPress Plugin Plugin: Inseri Core Affected Component: /includes/restapi.php Vulnerability Type: Broken Access Control Missing Authorization Status: Reported in August 2026– Closed as Duplicate. Summary Whilst testing this summer I came across a Broken Acces...

CVE-2024-48217

CVE-2024-48217 Sismart Vulnerability CVE Assigned: CVE-2024-48217 mitre.org nvd.nist.org tenable.com Date: 5 September 2024 Author: Ajriel Rizqy Maulana Software Link: SiSMART Aplikasi Pintar Penunjang Proses Pendidikan - 7.4.0 SiSMART Aplikasi Pintar Penunjang Proses Pendidikan API Version: 7.4....

CVE-2024-3656

Keycloak 24.0.5 is vulnerable to Broken Access Control vulnerability, where the attacker can use any authenticated user to perform some api action such as : Test LDAP connections via the testLDAPConnection endpoint. Retrieve unmanaged attributes of any user via the getUnmanagedAttributes endpoint...

ASUS-SmartHome-Exploit

ASUS-SmartHome-Exploit IDs de CVE CVE-2019-11061 : Control de acceso roto en HG100 Productos afectados : ASUS SmartHome Gateway HG100 Versión de firmware Productos afectados : Aplicación ASUS SmartHome Android APP versión 3.0.45190701 Descripción Si el atacante está en la misma red interna que el...

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197 Me presentaron una alerta de alta severidad que indicaba un posible intento de explotación de CVE-2023-22515, una vulnerabilidad de día cero en Atlassian Confluence. La alerta mostraba una solicitud GET...