CVE-2020-11107

CVE-2020-11107 This is a writeup for CVE-2020-11107 I've found. An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users including admins to enable arbitrary...

CVE-2024-31964

CVE-2024-31964 CVE-2024-31964 PoC: Mitel 6900w Series SIP Phone - Temporary Authentication Bypass Vulnerability details Summary It consists of a temporary authentication bypass vulnerability in the HTTP administrative website panel of several Mitel Products. Impact Allows an attacker to modify th...

CVE-2021-40113

CVE-2021-40113 Множественные уязвимости в веб-интерфейсе управления оптических сетевых терминалов ONT коммутаторов серии Cisco Catalyst Passive Optical Network PON могут позволить неаутентифицированному удалённому злоумышленнику выполнить следующие действия: войти в систему с учётными данными по...

Dji_ble_vuln

CVE-2026-78306 — POC внедрения команд DUML через Bluetooth в дронах DJI Запись CVE: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Описание Дроны DJI предоставляют Bluetooth-интерфейс, используемый для установления соединения с Wi-Fi-интерфейсом дрона ...

Rocky Linux 8 [CIQ] Security Update: dnf-plugin-subscription-manager / etc (crlsa-2023_4706)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234706 advisory. subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration CVE-2023-3899 Tenable has extracted th...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2024_1751)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241751 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuratio...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1768395381)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768395381 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

CVE-2021-42562

CVE-2021-42562 : Contrôle d'accès inapproprié dans MITRE Caldera Caldera versions =2.8.1 ne sépare pas correctement les privilèges des utilisateurs, ce qui donne aux utilisateurs non administrateurs la possibilité de lire et de modifier la configuration ou d'autres composants qui ne devraient êtr...

CVE-2026-95985: Inclusion of Functionality from Untrusted Control Sphere

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

CVE-2026-18185

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

EUVD-2026-85351

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18185 , which stems from missing authentication for a critical function (CWE-306). A remote attacker could exploit this flaw to access sensitive information and modify system configurations . The vulnerability im...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability

Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability discovered by ryan fabella in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

CVE-2026-87981 Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

PT-2026-97182

Name of the Vulnerable Software and Affected Versions Social Commerce for WooCommerce WordPress plugin versions prior to 2.5.5 Description Lack of authorization checks on certain REST API endpoints allows unauthenticated users to modify the plugin configuration and the product synchronization...

PT-2026-97352

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A missing authentication requirement for a critical function allows a remote attacker to access sensitive information and modify system...

CVE-2026-18185: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...