1073 matches found
lazyweb
LazyWeb - Aplicación Web Vulnerable LazyWeb es una aplicación web de demostración diseñada para mostrar vulnerabilidades comunes del lado del servidor. Cada vulnerabilidad está categorizada con su respectiva calificación de dificultad para proporcionar una experiencia de aprendizaje integral para...
Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite
Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...
ZimaOS - Authentication Bypass
ZimaOS = 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames. id: CVE-2026-21891 info: name: ZimaO...
Astra
Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...
CVE-2025-68860
CVE-2025-68860 WordPress Mobile builder Plugin Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder allows Authentication Abuse. This issue affects Mobile builder from n/a through 1.4.2. CVSS Score: 9.8 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A...
CVE-2025-68860
WordPress Mobile Builder = 1.4.2 - Autenticación Rota CVE-2025-68860 Descripción El plugin WordPress Mobile builder versión 1.4.2 y anteriores tiene una vulnerabilidad de Autenticación Rota que permite a un atacante crear un token JWT válido con el secreto predeterminado "examplekey" y autenticar...
CVE-2026-100870
Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to administrator password-reset poisoning. The software builds password-reset links using the request Host header without proper validation. This allows unauthenticated attackers to use forged Host headers to red...
Flowise-CVE-2025-58434-PasswordReset
CVE-2025-58434 — Flowise AI Unauthenticated Password Reset Overview CVE ID: CVE-2025-58434 Affected Software: Flowise AI Vulnerable Versions: = 3.0.5 Fixed Version: 3.0.6 and later Severity: Critical Author: arensballiu Date: 2025 Description Flowise AI versions up to and including 3.0.5 contain ...
CVE-2025-49901
CVE-2025-49901 El plugin Simple Link Directory de WordPress 14.8.1 es vulnerable a una Autenticación Rota de alta prioridad root@kitploit: ╔═══════════════════════════════════════════════════════════════════╗ ║ CVE-2025-49901 · Simple Link Directory · qc-opd ║ ║ Authentication Bypass → Password...
CVE-2025-47646
🔐 CVE-2025-47646 – Inicio de sesión y registro front-end de PSW = 1.12 📌 Información del plugin Plugin : PSW Front-end Login & Registration Versión vulnerable : = 1.12 CVE : CVE-2025-47646 Gravedad : Alta CVSS 9.8 Tipo de vulnerabilidad : Autenticación rota Privilegio requerido : No autenticado...
CVE-2026-86678 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...
CVE-2026-86677 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
CVE-2026-86683 Broken Authentication Vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
CVE-2022-1598
CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Plantilla de Nuclei: CVE-2022-1598.yaml...
CVE-2024-52475
CVE-2024-52475 El plugin Wawp de WordPress = 3.0.17 es vulnerable a autenticación rota toma de control de cuenta ¡Descargo de responsabilidad! La información proporcionada en este documento sobre CVE-2024-52475 es solo para fines educativos y de aprendizaje. No fomentamos ni autorizamos el uso de...
Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.24 / 11.3.x < 11.3.10 (JSDSERVER-16729)
The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16729 advisory. - This High severity BASM Broken Authentication & Session Management vulnerability known as...
CVE-2026-62108
Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...
CVE-2026-62101
Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...
