CVE-2025-32432

Conjunto de herramientas de explotación para CraftCMS CVE-2025-32432 Herramienta de explotación de ejecución remota de código en CraftCMS basada en la investigación de SensePost. 📁 Descripción de archivos 🎯 Herramientas principales 1. finalpoc.py - POC final optimizado Soporta fuga de información...

CVE-2025-65670

CVE-2025-65670 Una referencia directa a objetos insegura IDOR en classroomio 0.1.13 permite a los estudiantes acceder a endpoints sensibles de administradores/profesores mediante la manipulación de IDs de cursos en las URL, lo que resulta en la divulgación no autorizada de datos sensibles del...

CVE-2024-8949-POC

Vulnerabilidad de Control de Acceso Roto descubierta en el sitio web de compras de gafas en línea de Sourcecodester: la manipulación de ID/Cart ID permite la adición y eliminación no deseadas de artículos en el carrito del usuario CVE-2024-8949 Vendedor: Sourcecodester...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – GraphQL Persisted Queries Injection via ID Manipulation Program Code Node.js // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ; app.post'/graphql',...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — Proyecto de demostración BOLA CVE-2023-27524 🔐 Demostración de Autorización a Nivel de Objeto Roto BOLA Análisis de Seguridad y Corrección de CVE-2023-27524 --- 📌 Resumen del Proyecto Este proyecto demuestra una vulnerabilidad real de Autorización a Nivel de Obje...

CVE-2026-96880 TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization

A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper...

CVE-2026-96880 TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization

A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper...

CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-90851

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2026-90796

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-90697

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-90697 SourceCodester Inventory Management System invoice.php authorization

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

EUVD-2026-77329

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

PT-2026-91118

Name of the Vulnerable Software and Affected Versions SourceCodester Inventory Management System version 1.0 Description An authorization bypass exists in the invoice.php file. A remote attacker can exploit this by manipulating the ID argument, allowing them to bypass security checks and gain...

CVE-2026-90579

CVE-2026-90579 affects Cheshire Cat AI up to version 1.9.2 . The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id argument leads to missing authentication . An unauthenticated remote attacker can exploit this over t...

CVE-2026-90521

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

CVE-2026-90521 jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

EUVD-2026-77012

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

CVE-2026-90521 jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

CVE-2026-90521

A remote authorization bypass vulnerability was identified in the jaychouchannel Tourism-Management-System (a GitHub-based project using rolling releases), affecting the file MenpiaodingdanController.java within the CRUD component. The root cause is the manipulation of the ID argument , which all...