CVE-2023-30765

CVE-2023-30765 CVE-2023-30765 / ZDI-23-905 - Delta Electronics Infrasuite Device Master Privilege Escalation Bug credit: Piotr Bazydlo @chudypb Links: https://www.zerodayinitiative.com/advisories/ZDI-23-905/ https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01 Usage python3...

HTC

HTC | HackTheCCTV DVRs Credentials Exposed | CVE-2018-9995 | The CCTV Leaked Username For Get Loggin Access Usage Open https://www.zoomeye.org/ Search With Keywod : /login.rsp $ python3 thecctv.py...

ESPTouchCatcher

eWeLink mobile Application - Incorrect Access Control Vulnerability CVE-2020-12702 Weak encryption in the Quick Pairing mode in the eWeLink mobile application Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier allows physically proximate attackers to eavesdrop on Wi-Fi...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken Never Re-Validates Account State Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 High CNA: Turan Security · CVE record Description Shiori's CheckToke...

CVE-2026-13714

Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code Execution RCE...

CVE-2025-70829

CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Nexus Findings Report 📋 Overview This repository contains a comprehensive penetration test report for the Hack The Box machine Nexus. 🔍 Key Findings Exposed Credentials in Gitea Commit History - Medium Severity Krayin CRM Unrestricted File Upload CVE-2026-38526 - High Severity...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

EUVD-2026-98205

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

CVE-2023-30146

CVE-2023-30146 - Assmann/HooToo Webcam Exploit - Sensitive Data Exposure Description An issue was discovered in HooToo and Assmann branded IP-Cameras. The firmware stores the administrator and user credentials in the backup in plaintext. The backup can be retrieved and decompressed without...

EUVD-2026-98180

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

EUVD-2026-98080

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

EUVD-2026-98156

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

EUVD-2026-98193

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenantsubdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated...

CVE-2026-89111

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability (CWE-918) affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server they control. This allows for the exfiltration of client credentials . The v...

CVE-2026-18318

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication...

APSB26-163 : Security update available for Adobe Content Credentials SDK

Adobe has released a priority 3 security update for Adobe Content Credentials SDK. This update addresses vulnerabilities rated high and medium that could result in security feature bypass, application denial-of-service, and arbitrary file system write. Adobe is not aware of any exploits in the wi...

PT-2026-113512

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

PT-2026-113524

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...