web-check

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: NinjaPear API to get a full B2B profiles from any URL | Hostinger Deploy Web-Check with one click on Hostinger | Warp Built for coding with multiple AI agents ---|---|--- Contents About...

rbndr

rbndr Servicio simple de Rebinding DNS rbndr es un servidor de nombres muy simple y no conforme para probar software contra vulnerabilidades de DNS rebinding. El servidor responde a consultas seleccionando aleatoriamente una de las direcciones especificadas en el nombre de host y devolviéndola co...

CVE-2026-108702 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESSSETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe...

CVE-2026-108730: Missing Authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public chann...

PT-2026-110354

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection issue exists within the Inbound Quality Check Pda Interface component. The flaw is located in the WmInQmIController.list function within the...

PT-2026-110051

Name of the Vulnerable Software and Affected Versions KeyWord Collector versions prior to 1.5 Description Lack of authorization and nonce checks when saving settings allows unauthenticated attackers to perform a stored Cross-Site Scripting XSS attack. This occurs because the plugin fails to escap...

PT-2026-110068

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

CVE-2026-88905: Improper Neutralization of Input During Web Page Generation

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

web-check — Updated!

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: NinjaPear API to get a full B2B profiles from any URL | Hostinger Deploy Web-Check with one click on Hostinger | Warp Built for coding with multiple AI agents ---|---|--- Contents About...

CVE-2024-6387_Check

Este repositorio no tiene un README...

CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CLEANSTART-2026-UI77772 Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team,...

Security vulnerability affects the airflow-3 package. Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site...

GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

CVE-2026-107854

The Jexactyl game management and billing system (versions 4.0.0 to 4.0.5 ) contains an authorization bypass vulnerability in the POST /api/client/billing/free/process endpoint. The application fails to verify ownership when processing a client-controlled server_id , allowing an authenticated user...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

CVE-2026-107843

The Contao Open Source CMS (versions 4.1.0 through 5.3.50 and 5.7.12 ) contains a vulnerability where the ModuleRegistration::compile() function fails to verify FORM_SUBMIT or captcha results on unauthenticated POST requests. This allows an unauthenticated attacker to trigger the resendActivation...

CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-29797 Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP...