CVE-2026-82043

Versions of UTMStack prior to 11.2.16 are vulnerable to an account enumeration flaw. An unauthenticated attacker can identify registered email addresses by sending requests to the POST /api/account/reset-password/init endpoint. The application provides different HTTP responses based on the existe...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

HTB-TwoMillion-machine

Hack The Box - TwoMillion: الشرح نظرة عامة يحتوي هذا المستودع على الشرح الخاص بجهاز Hack The Box - TwoMillion. الهدف من هذا الشرح هو توثيق المنهجية التي اتبعتها، وشرح عملية التعداد، وعرض سلسلة الاستغلال التي قادت إلى الوصول إلى صلاحيات المستخدم والجذر. إخلاء مسؤولية: هذا الشرح مخصص للأغراض...

ragflow-audit

ragflow-audit أداة تدقيق لثلاث ثغرات في RAGFlow CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : يكتشف ويستغل SSTI - RCE في مكوّني StringTransform / Message zipslip : يكشف تجاوز المسار Zip Slip في مدخلات zip دون اتصال apikey : يستنتج مفتاح API من beta في رابط المشاركة تعداد الطابع الزمني...

Massive-Subdomain-Enumerator

Massive-Subdomain-Enumerator Cet outil utilise une combinaison de listes de mots basées sur un dictionnaire force brute et de vérifications de résolution DNS pour confirmer l'existence de sous-domaines. Fonctionnalités Traitement des listes de mots : Capable de gérer efficacement de grandes liste...

spaces-finder

Spaces finder Spaces finder هي أداة لاستعراض DigitalOcean Spaces بسرعة بحثًا عن الغنائم. إنها مشابهة لأداة تخمين النطاقات الفرعية لكنها مصممة خصيصًا لـ DigitalOcean Spaces ولديها أيضًا بعض الميزات الإضافية التي تسمح لك بالبحث عن ملفات قيّمة بالإضافة إلى تنزيل الملفات المثيرة للاهتمام إذا كنت لا...

UserEnumJira

इस रिपॉजिटरी में README नहीं है।...

CVE-2026-104439

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

EUVD-2026-91449

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439

YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

EUVD-2026-91258

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.1 . The flaw exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as an unauthenticated route via wp...

EUVD-2026-91127

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

PT-2026-104140

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.2 Description An Insecure Direct Object Reference exists via the OsPaypalConnectController::create order for transaction action, which is registered as a public route throug...

CVE-2026-82043: Observable Response Discrepancy

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...