Lucene search
+L

494 matches found

Kitploit
Kitploit
added 2026/09/16 2:26 a.m.8 views

CVE-2024-8949-POC

Broken Access Control Vulnerability was discoverd in Sourcecodester Online Eyewear Shopping Website ID,Cart ID Manipulation Leads to Unwanted Item Addition and Deletion into User's Cart CVE-2024-8949 Vendor: Sourcecodester...

8.8CVSS6.7AI score0.00723EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/15 2:16 a.m.6 views

CVE-2026-90851

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

6.5CVSS0.00209EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/14 5:17 p.m.4 views

CVE-2026-90796

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

6.5CVSS0.0025EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/14 9:17 a.m.6 views

CVE-2026-90697

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

5.3CVSS0.00238EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/14 8:15 a.m.34 views

CVE-2026-90697 SourceCodester Inventory Management System invoice.php authorization

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

5.3CVSS0.00238EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/14 8:15 a.m.6 views

EUVD-2026-77329

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

5.3CVSS5.3AI score0.00238EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/13 7:00 p.m.17 views

CVE-2026-90579

CVE-2026-90579 affects Cheshire Cat AI up to version 1.9.2 . The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id argument leads to missing authentication . An unauthenticated remote attacker can exploit this over t...

7.5CVSS6.7AI score0.00391EPSS
SaveExploits0References5
NVD
NVD
added 2026/09/13 1:16 p.m.9 views

CVE-2026-90521

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

6.5CVSS0.00393EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/13 12:45 p.m.9 views

EUVD-2026-77012

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

6.5CVSS6AI score0.00393EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/09/13 12:45 p.m.37 views

CVE-2026-90521 jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

6.5CVSS0.00393EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/13 12:45 p.m.16 views

CVE-2026-90521

A remote authorization bypass vulnerability was identified in the jaychouchannel Tourism-Management-System (a GitHub-based project using rolling releases), affecting the file MenpiaodingdanController.java within the CRUD component. The root cause is the manipulation of the ID argument , which all...

6.5CVSS6AI score0.00393EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/13 5:24 a.m.10 views

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project root@kitploit: 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and it...

9.8CVSS8.4AI score0.97405EPSS
SaveExploits19
Positive Technologies
Positive Technologies
added 2026/09/13 12:00 a.m.14 views

PT-2026-90855

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

6.5CVSS6AI score0.00393EPSS
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/12 4:16 a.m.9 views

CVE-2025-65670

CVE-2025-65670 classroomio 0.1.13 中存在不安全的直接对象引用(IDOR),允许学生通过操纵 URL 中的课程 ID 来访问管理员/教师的敏感端点,导致敏感课程、管理员和学生数据在系统恢复到正常限制状态之前短暂泄露。发现者:Rivek Raj Tamang RivuDon,印度锡金。 受影响产品:ClassroomIO 受影响版本:0.1.13 发现者:Rivek Raj Tamang RivuDon,印度锡金 漏洞详情 不安全的直接对象引用 / 访问控制缺陷 摘要 此漏洞允许学生级别的用户通过直接操纵 URL 中的课程...

4.3CVSS5.8AI score0.00244EPSS
SaveExploits2
RedhatCVE
RedhatCVE
added 2026/09/10 6:06 p.m.10 views

CVE-2026-88024

A flaw was found in the GridFS component of the MongoDB Rust Driver. An authenticated user can exploit this vulnerability by manipulating a file identifier, causing it to be misinterpreted as a query condition. This improper handling of special elements in data query logic can lead to unauthorize...

8.8CVSS5.6AI score0.00319EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 5:31 p.m.6 views

CVE-2025-32432

CraftCMS CVE-2025-32432 Exploit Toolkit Exploitation tools for CraftCMS Remote Code Execution vulnerability based on SensePost research. 📁 File Description 🎯 Main Tools 1. finalpoc.py - Final optimized POC Supports information disclosure and remote code execution Automatic asset ID discovery...

10CVSS8.7AI score0.99837EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/09 4:38 a.m.6 views

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – GraphQL Persisted Queries Injection via ID Manipulation Program Code Node.js root@kitploit: // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ;...

3.8CVSS7.7AI score0.00193EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/07 12:29 p.m.7 views

EUVD-2026-72366

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

5.3CVSS5.6AI score0.00298EPSS
SaveExploits0References5
NVD
NVD
added 2026/09/07 10:16 a.m.5 views

CVE-2026-86293

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...

6.9CVSS0.00726EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/07 9:45 a.m.11 views

CVE-2026-86293

A missing authentication flaw exists in the Deletion Endpoint (file delete-user.php) of SourceCodester Simple Traffic Offense System 1.0 . By manipulating the ID argument remotely without authentication, an attacker can perform unauthorized deletion operations, resulting in low integrity and low ...

6.9CVSS6.3AI score0.00726EPSS
SaveExploits0References6
Rows per page
Query Builder