CVE-2025-2304-CamaleonCMS-PoC

PoC: CVE-2025-2304 - Camaleon CMS Privilege-Eskalation Technischer Überblick Dieses Repository enthält einen funktionalen Proof of Concept PoC für eine Mass Assignment -Sicherheitslücke in Camaleon CMS Versionen vor 2.8.1. Die Schwachstelle befindet sich im updatedajax-Endpunkt des...

Mass-Assigner

Mass Assigner Mass Assigner ist ein leistungsstarkes Tool, das entwickelt wurde, um Mass Assignment-Schwachstellen in Webanwendungen zu identifizieren und auszunutzen. Dies wird erreicht, indem zunächst Daten von einer angegebenen Anfrage abgerufen werden, z. B. durch Abrufen von...

CVE-2025-2304

Camaleon CMS -p Argumentos -t, --target URL base do alvo -u, --username Nome de usuário válido de baixo privilégio -p, --password Senha do usuário Fluxo do Exploit 1. Recuperar a página de login e extrair o token CSRF 2. Autenticar com as credenciais fornecidas 3. Acessar a página de edição de...

Exploit-for-CVE-2025-2304

Exploit-for-CVE-2025-2304 usage: exploit.py -h --url URL --username USERNAME --password PASSWORD Descrição O Camaleon CMS é afetado por uma vulnerabilidade de escalonamento de privilégios devido a uma atribuição em massa insegura. O método updatedajax no UsersController usa a função permit!,...

CVE-2025-2304-PoC

CVE-2025-2304 Exploit Camaleon CMS Vulnerável a Escalação de Privilégio através de uma Atribuição em Massa Descrição da Vulnerabilidade Existe uma Escalação de Privilégio através de uma Atribuição em Massa no Camaleon CMS Quando um usuário deseja alterar sua senha, o método 'updatedajax' do...

CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC é uma prova de conceito para a vulnerabilidade CVE-2025-15602 no Snipe-IT. Um script para listar todos os usuários e um script para assumir o controle de uma conta de superadmin. Contexto Um usuário tem apenas o direito de editar usuários; ele pode abusar dis...

CVE-2026-55067

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

GHSA-569V-Q83C-3J3G Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067

Vikunja , an open-source self-hosted task management platform, is affected by a cross-tenant mass-assignment flaw prior to 2.4.0 . In pkg/models/kanban.go, the Bucket.Update function writes the request body's project_view_id without validating the destination view; the permission check only confi...

EUVD-2026-67834

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2025-2304-Camaleon-CMS-Mass-Assignment-Privilege-Escalation-PoC

CVE-2025-2304 — Camaleon CMS Escalação de Privilégios por Mass Assignment PoC Vulnerabilidade de escalação de privilégios no Camaleon CMS /updatedajax com passwordrole=admin injetado nos parâmetros de senha. 4. Verifica se a função foi atualizada para admin. Requisitos Python 3 Instale as...

CVE-2025-2304-exploit

CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation 📌 Descrizione del Progetto CVE-2025-2304 è una vulnerabilità di Mass Assignment in Camaleon CMS versioni 2.9.1 che permette a un utente autenticato di elevare i propri privilegi ad amministratore manipolando il parametro role nelle...

CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Exploit di Escalation dei Privilegi Panoramica Questo script Python sfrutta una vulnerabilità critica di mass assignment in Camaleon CMS versione 2.9.0, consentendo a qualsiasi utente registrato di elevare i propri privilegi ad amministratore. Dettagli della...

Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

CVE-2025-2304-POC

CVE-2025-2304 Escalation dei privilegi in Camaleon CMS Esempio root@kitploit: python3 exploit.py http://target.com attacker attacker Dopo lo sfruttamento riuscito, esci e accedi di nuovo per ottenere i privilegi di amministratore. Riferimenti https://nvd.nist.gov/vuln/detail/CVE-2025-2304...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Inspiriert von https://github.com/dreadlocked/Drupalgeddon2 Unterstützt: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, Angriff auf account/mail & postrender Parameter, unter Verwendung der PHP-Funktion...

CVE-2022-45265

CVE-2022-45265 Nel Sanitization Management System 1.0 distribuito da sourcecodester.com root@kitploit: curl --location --request POST 'http://localhost/php-sms/classes/Users.php?f=save' \ --form 'id="1"' \ --form 'firstname="HACKED"' \ --form 'lastname="Administrator"' \ --form 'username="admin"'...

CVE-2023-7028

GitLab CVE-2023-7028 POC root@kitploit: [email protected]&[email protected] Forschungsinstitut mit Sitz in Chengdu – Einstellung von Cybersicherheitsforschern privat...