PT-2026-93748

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.18.1 Description The ListUsers API could incorrectly return a user who should have been excluded. This occurs when an authorization relation uses an intersection containing a base but not excluded operand, the base ...

Sanity / Directus Token Abuse

Uses leaked Sanity sk tokens for GROQ queries and Directus static tokens to list users. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked Sanity and Directus API tokens.""" from kittysploit import from lib.protocols.http.httpclient import...

Contest Gallery < 13.1.0.6 - SQL injection Detection

The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users...

CVE-2026-44595 Yamcs: Unauthorized user enumeration via IAM API endpoints

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one...

CVE-2026-44595 Yamcs: Unauthorized user enumeration via IAM API endpoints

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the IAM API endpoints, including listUsers, getUser, listGroups, and getGroup. An attacker can retrieve sensitive user information, such as usernames, superuser status, and group memberships, by sending...

CMS Made Simple: Code Injection Vulnerability

CMS Made Simple CMSMS is an open-source content management system developed by the Cmsms team. This system supports role-based permission management systems, wizard-based installation and update mechanisms, and intelligent caching features. Versions of CMS Made Simple prior to 2.2.21 contained a...

CVE-2025-41077 Multiple vulnerabilities in Viafirma products

IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality ...

PYSEC-2025-233

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue...

CVE-2025-67715: Improper Access Control

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue...

EUVD-2025-200242

Calibre-Web Has a Stored Cross-Site Scripting XSS Vulnerability via the 'username' Field During User Creation...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

List all users from /etc/passwd

List all users from /etc/passwd from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "List all users from /etc/passwd", "description": "List all users from /etc/passwd", "author": "KittySploit Team", "arch": Arch.PHP, "tags": "php...

CVE-2025-27929: Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

PT-2023-18585

Name of the Vulnerable Software and Affected Versions WP Activity Log plugin for WordPress versions up to, and including, 4.5.0 Description The issue is related to a missing capability check on the handle ajax call function, allowing authenticated attackers with subscriber-level access or higher ...

CVE-2021-4337

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wpajaxsvxajaxfactory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2022-4417: Undefined Security Weakness

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users...

CVE-2020-21884

Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery CSRF vulnerability in /tools/network-trace, /listusers, /listbyod?usertype=raduser, /dhcpleases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device...