CVE-2019-20085

📂 CVE-2019-20085 – Exploit de traversée de répertoire TVT NVMS-1000 Par Z3R0 Auteur : Z3R0 CVE : CVE-2019-20085 Cible : TVT NVMS-1000 toutes les versions connues antérieures au correctif Type de vulnérabilité : Traversée de répertoire non authentifiée Date : Insérez votre date de publication 🔍...

CVE-2024-57241

CVE-2024-57241CNNVD-2024-34500830 Для веб-приложений, использующих DEDECMS 5.71SP1 и более ранние версии, происходят URL-редиректы, поскольку ошибка логики исходного кода CMS не проверяет входящий GET-запрос Для веб-приложений на dedecms 5.71SP1 и ниже происходит URL-редирект, так как из-за ошибк...

CVE-2023-23752

CVE-2023-23752 Programme simple pour le scanner de la CVE-2023-23752 de Joomla, Ceci est un script Ruby simple qui vérifie si une liste de cibles est vulnérable à la CVE-2023-23752, une vulnérabilité de sécurité critique dans une application web. Le script envoie une requête HTTP GET à un point...

Reprise License Manager 14.2 - Cross-Site Scripting

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. id: CVE-2021-45422 info: name: Reprise License Manager 14.2 - Cross-Site Scripting author: edoardottt severity: medium description: | Reprise License Manager 14.2...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

CVE-2026-37070

CVE-2026-37070 Contrôle d'accès incorrect dans /vfm-admin/ajax/streamvid.php du projet Veno File Manager en version 4.4.9 permet à un attaquant authentifié de lire tous les fichiers téléversés par d'autres utilisateurs à condition qu'il connaisse le chemin et le nom du fichier via une requête GET...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE

Nom du projet et URL du dépôt : Système de gestion de recrutement de personnel de maison utilisant PHP et MySQL Type de vulnérabilité : Falsification de requête côté client Versions affectées : v1.0 💣Description de la vulnérabilité : Une vulnérabilité de falsification de requête intersite CSRF...

CVE-2026-104448

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104451

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104451 YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

Drupal-cve-2019-6340

Recherche CVE 2019-6340 Le site avec le module Drupal 8 core RESTful API Services activé permet à l'utilisateur d'envoyer des requêtes GET, PATCH ou POST au serveur. Une requête GET suffit pour déclencher la vulnérabilité d'exécution de code même si la méthode PATCH est désactivée Le site a tout...

Linux Distros Unpatched Vulnerability : CVE-2026-58415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote...

CVE-2023-35793-CSRF-On-Web-SSH

CVE-2023-35793-CSRF-On-Web-SSH Le dépôt contient la description de la CVE-2023-35793 découverte par l'équipe Dodge Industrial pour la plateforme Dodge OPTIFY. ID CVE: CVE-2023-35793 Vendeur : Cassia Networks Produit : Access Controller Version : Cassia-AC-2.1.1.2303271039 Vulnérabilité :...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2025-25296

CVE-2025-25296 Доказательство концепции POC Описание Этот проект демонстрирует доказательство концепции POC для уязвимости CVE-2025-25296, затрагивающей Label Studio, инструмент разметки данных с открытым исходным кодом. Уязвимость находится в конечной точке /projects/upload-example, которая не...

CVE-2026-102628

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...

CVE-2026-102628

The Cadmos LTI application (hosted at cadmos.eummena.io) was vulnerable because Laravel debug mode was enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could trigger an unhandled exception via a GET request , causing the application to expo...