Lucene search
+L

128 matches found

Kitploit
Kitploit
added 2026/09/12 5:16 a.m.12 views

tangalanga

Tangalanga Zoom 회의 스캐너. 이 스캐너는 무작위 회의 ID를 확인하고 사용 가능한 정보를 반환합니다. 설치 먼저 해당 날짜에 미리 빌드된 버전이 있는지 확인하세요: https://github.com/elcuervo/tangalanga/releases. 이 버전에는 이미 사용 가능한 토큰이 포함되어 있습니다. 어느 쪽이든 Windows, Linux 및 Mac 버전은 Releases https://github.com/elcuervo/tangalanga/releases 에서 찾을 수 있습니다. 다운로드하고 압축을 풀고...

6AI score
SaveExploits0References1
CVE
CVE
added 2026/09/09 6:00 a.m.13 views

CVE-2026-81021

The SupportCandy WordPress plugin (versions 3.2.9 through 3.5.2) contains a missing authorization check on one of its support-ticket attachment download paths. This allows unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers. T...

5.3CVSS0.00206EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/08 1:19 p.m.8 views

CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...

6.1CVSS0.00251EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/07 1:55 p.m.4 views

CVE-2023-2986

CVE-2023-2986 的原始概念验证(PoC) WordPress 插件 'Abandoned Cart Lite for WooCommerce' 中漏洞 CVE-2023-2986 的概念验证 相关详情 NVD 链接:https://nvd.nist.gov/vuln/detail/CVE-2023-2986 插件源码:https://github.com/TycheSoftwares/woocommerce-abandoned-cart/ 受影响版本:version 在浏览器中输入该 URL 即可获得对相应用户账户的访问权限。如果 WordPress...

9.8CVSS8.1AI score0.42544EPSS
SaveExploits5References1
NVD
NVD
added 2026/09/05 11:16 a.m.7 views

CVE-2026-86178

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

5.4CVSS0.00184EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/05 11:01 a.m.35 views

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

5.4CVSS0.00184EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/05 11:01 a.m.6 views

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

5.3CVSS5.8AI score
SaveExploits0References8
NVD
NVD
added 2026/09/05 10:16 a.m.7 views

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

7.1CVSS0.0025EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/05 9:59 a.m.6 views

EUVD-2026-71943

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

7.1CVSS5.3AI score0.0025EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/05 9:59 a.m.35 views

CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

7.1CVSS0.0025EPSS
SaveExploits0References5
NVD
NVD
added 2026/09/04 3:17 p.m.5 views

CVE-2026-85624

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

7.1CVSS0.00393EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/04 2:32 p.m.9 views

CVE-2026-85624

Blinko 1.8.7 is vulnerable to a cross-user private note disclosure in the noteReferenceList procedure, which performs no ownership verification on supplied note identifiers. An authenticated attacker can enumerate sequential note IDs to retrieve the complete content of other users' private notes ...

7.1CVSS5.2AI score0.00393EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/04 12:17 p.m.8 views

CVE-2026-85616

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...

8.5CVSS0.00267EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 11:30 a.m.6 views

EUVD-2026-71035

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...

8.5CVSS5.5AI score0.00267EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.18 views

PT-2026-85540

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

8.8CVSS5.3AI score0.00462EPSS
SaveExploits0References7
OSV
OSV
added 2026/09/03 11:04 p.m.7 views

GHSA-5FHR-F75J-8WR9 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...

5.8CVSS5.9AI score0.00237EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/29 6:00 a.m.9 views

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

2.7CVSS5.9AI score0.00179EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/27 6:16 a.m.14 views

CVE-2026-16567

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

5.3CVSS0.00193EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 6:00 a.m.20 views

CVE-2026-16567

CVE-2026-16567 affects the Document Embedder WordPress plugin before version 2.3.1 . The plugin does not verify a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary documents—including private and draft ones—by enumer...

5.3CVSS5.7AI score0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 6:00 a.m.5 views

EUVD-2026-66870

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

5.3CVSS5.5AI score0.00193EPSS
SaveExploits0References1
Rows per page
Query Builder