CVE-2026-18422

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

EUVD-2026-79942

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-73317

CVE-2026-73317 XenForo anterior a 2.3.13 permite que un administrador con solo el permiso de reconstrucción de caché envíe un trabajo de aprobación como otro usuario. Qué sucede El endpoint de reconstrucción del ACP acepta una clase de trabajo y opciones proporcionadas por el llamante. Su...

traefik-stripprefix-auth-bypass-cve-2026-48020-path-normalization

CVE-2026-48020 — Bypass de autenticación a nivel de ruta en StripPrefix de Traefik PoC Un proof of concept autocontenido para CVE-2026-48020 , un bypass de autenticación/autorización a nivel de ruta en el middleware StripPrefix de Traefik causado por la normalización de rutas que ocurre después d...

thm-Moniker-Link-cve-2024-21413-writeup

TryHackMe: Moniker Link CVE-2024-21413 Ruta: Cyber Security 101 → Exploitation Basics → Moniker Link CVE-2024-21413 Dificultad: Sala premium Enfoque: Omisión de Vista Protegida de Outlook, fuga de hash NTLM y captura de credenciales con Responder CVE-2024-21413 es una vulnerabilidad crítica de...

DsArk64

DsArk64 DsArk64.sys se distribuye con 360 Total Security. Firmado por WHQL de Microsoft. LOLDrivers: magicsword-io/LOLDrivers308. CVE: Solicitado MITRE. Primitivas Terminación de procesos ring 0 IOCTL 0x80863008, entrada: PID en bruto de 4 bytes El driver llama a ZwOpenProcessALLACCESS +...

EAC-Kernel-Packet-Fucker

EAC-Kernel-Packet-Fucker No es mi código. Solo para guardarlo https://www.unknowncheats.me/forum/anti-cheat-bypass/503052-easy-anti-cheat-kernel-packet-fucker.html Este es el Easy Anti-Cheat Kernel Packet Fucker para abreviar, EACKPFucker. ¿Qué es esto? Básicamente, los paquetes a través de su...

EAC

العربية يوجدت نسختين من EAC: الأولى مدفوعة وتسمى EAC، والأخرى مجانية وتسمى EOC وهي الأكثر شيوعًا في معظم الألعاب. لقد قمت برفع SDK لمساعدتك في فهم كيفية عمل EAC. على كل حال، يعتبر EOC أضعف من النسخة المدفوعة بحكم أنه مجاني، ولكن هذا لا يمنع المطورين من شراء ميزات إضافية. ما أريد تسليط الضوء عليه...

palo-alto-cve-2026-0265-checker

Comprobador de riesgo CVE-2026-0265 para Palo Alto PAN-OS Un script de Python que se conecta a una lista de firewalls de Palo Alto Networks y dispositivos Panorama a través de SSH e informa de la exposición de cada dispositivo a CVE-2026-0265, una vulnerabilidad de omisión de autenticación en...

EUVD-2026-79504

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

bypass360mimikatz_x64

Método: modificar recursos y añadir firma digital Contraseña de descompresión: 6613kris清水川崎...

CVE-2020-5421

Replicación de la vulnerabilidad de seguridad Spring CVE-2020-5421 Resumen de la vulnerabilidad CVE-2020-5421 puede eludir la protección contra ataques RFD mediante el parámetro de ruta jsessionid. La protección anterior contra RFD se agregó para abordar CVE-2015-5211. ¿Qué es RFD? La...

CVE-2026-24733

CVE-2026-24733 ¿Qué es CVE-2026-24733? Apache Tomcat manejaba incorrectamente una solicitud HEAD al estilo HTTP/0.9 bajo ciertas configuraciones de restricciones de seguridad. Verificador defensivo de CVE-2026-24733 Un verificador de seguridad en Python ligero y sin dependencias para CVE-2026-247...

CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

EUVD-2026-79235

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

EUVD-2026-79214

Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative...

CVE-2026-76688

Multiple authentication bypass vulnerabilities in the web-based management interface of HPE EdgeConnect SD-WAN Orchestrator allow an unauthenticated remote actor to circumvent authentication controls. Successful exploitation grants administrative privileges , potentially leading to complete compr...

CVE-2026-76684

HPE Networking EdgeConnect SD-WAN Orchestrator contains authentication bypass vulnerabilities in its API . An unauthenticated remote actor can circumvent existing authentication controls, potentially gaining administrative privileges and achieving complete compromise of the Orchestrator host. The...

EUVD-2026-79210

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading ...

CVE-2026-76677

CVE-2026-76677 is an authorization bypass in the API of HPE Networking EdgeConnect SD-WAN Gateways that enables a remote, low-privileged authenticated user to escalate to administrative access on the web-management interface, potentially leading to complete system compromise . The vulnerability i...