CVE-2026-93852

OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...

EUVD-2026-83178

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

CVE-2023-22515-Scan

CVE-2023-22515-Scan 개요 이것은 CVE-2023-22515에 대한 간단한 스캐너입니다. CVE-2023-22515는 Atlassian Confluence Data Center 및 Server의 치명적인 취약점으로, 현재 위협 행위자들이 활발히 악용하여 "승인되지 않은 Confluence 관리자 계정을 생성하고 Confluence 인스턴스에 접근"하고 있습니다. 이 취약점은 처음에 "권한 상승" 문제로 설명되었지만, Atlassian은 나중에 보안 권고에서 분류를 "손상된 접근 제어"로 변경했습니다...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

ASUS-SmartHome-Exploit

ASUS-SmartHome-Exploit CVE ID CVE-2019-11061 : HG100의 취약한 접근 제어 영향을 받는 제품 : ASUS SmartHome Gateway HG100 펌웨어 버전 영향을 받는 제품 : ASUS SmartHome Android 앱 버전 : optional arguments: -h, --help show this help message and exit -u, --list-user list all user in device -l, --list-d...

CVE-2024-3656

Keycloak 24.0.5 は、破損したアクセス制御 （Broken Access Control）の脆弱性の影響を受けます。攻撃者は認証された任意のユーザーを使用して、以下のようなAPIアクションを実行できます。 testLDAPConnection エンドポイントを介した LDAP 接続のテスト getUnmanagedAttributes エンドポイントを介した任意のユーザーの管理されていない属性の取得 getProviders エンドポイントを介したクライアント登録ポリシープロバイダーへのアクセス 私は testLDAPConnection...

CVE-2026-67102

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

EUVD-2026-82768

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-67102

HCL BigFix Service Management is affected by a Broken Access Control vulnerability that allows a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. The CVSS v3.1 score is 8.1 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-12384 Broken Access Control in TECHIN2B Application

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-12384

CVE-2026-12384 is an authorization bypass through a user-controlled key in the TECHIN2B Application , enabling privilege abuse . The affected version range is V1.0.7676.13 through 18092026 . The vulnerability is categorized as Broken Access Control and carries a CVSS 3.1 base score of 8.8 (HIGH) ...

CVE-2024-48217

CVE-2024-48217 Sismart 취약점 CVE 할당: CVE-2024-48217 mitre.org nvd.nist.org tenable.com 날짜: 2024년 9월 5일 작성자: Ajriel Rizqy Maulana 소프트웨어 링크: SiSMART Aplikasi Pintar Penunjang Proses Pendidikan - 7.4.0 SiSMART Aplikasi Pintar Penunjang Proses Pendidikan API 버전: 7.4.0 취약점: IDOR - 세션 저장소 내부 IDOR은 안전하지 않...

EUVD-2026-82681

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - 로컬 서버의 손상된 접근 제어 타임라인 취약점 공급업체에 보고: 22.09.2023 수정된 1.1.9.4 버전 출시: 08.12.2023 공개: 15.12.2023 설명 IBM i Access Client Solutions는 임시 비밀번호 암호화 키를 저장하기 위해 별도의 로컬 서버를 사용하며, 이 서버는 임의의 tcp6 포트에서 시작됩니다. 애플리케이션은 이 임시 암호화 키를 어떠한 접근 제어 없이 검색합니다. netstat...

CVE-2023-22515-Scan.

CVE-2023-22515-Scan 概要 これは、CVE-2023-22515のためのシンプルなスキャナーです。CVE-2023-22515は、Atlassian Confluence Data CenterおよびServerの深刻な脆弱性であり、脅威アクターによって実際に悪用され、不正なConfluence管理者アカウントを作成し、Confluenceインスタンスにアクセスするために使用されています。この脆弱性は当初「権限昇格」の問題として説明されていましたが、Atlassianは後にセキュリティアドバイザリで分類を「アクセス制御の破綻」に変更しました。...

CVE-2026-77170

CVE-2026-77170 affects the Deck config API , where an insufficient authorization check allows any authenticated user to set board-scoped configuration keys for arbitrary board IDs without verifying ownership or management permission over the referenced board. The impact is rated MEDIUM (CVSS 3.0:...

CVE-2025-15260

CVE-2025-15260: 認可欠如 / アクセス制御破損 – MyRewards – Loyalty Points and Rewards for WooCommerce プラグイン 免責事項: このリポジトリは教育目的および倫理的な開示のみ のために作成されています。この脆弱性はベンダーに責任を持って報告され、パッチが適用済みです。適切な許可なくこの情報を利用してシステムを悪用しないでください。 概要 WooCommerce 用プラグイン MyRewards WooRewardsバージョン = 5.6.0において、深刻なアクセス制御破損 /...

CVE-2023-22515

CVE-2023-22515 CVE-2023-22515 주요 정보 영향을 받는 제품: Atlassian Confluence Data Center 및 Confluence Server. 공개일: 2023-10-04. 심각도: Critical CVSS 10.0. 취약점 유형: Broken Access Control / Improper Authorization → 공격자가 원격으로 관리자 계정을 생성 할 수 있습니다. 취약점은 Confluence 설정 메커니즘 에 있습니다. 영향: Confluence Data Center 및 Serve...