CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"","use...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

CVE-2024-48955_Overview

CVE-2024-48955概述 描述： Netadmin 4 IAM 存在访问控制缺陷。 受影响版本：V4.030319 NetAdmin 系统在用于“组装”功能菜单的端点上返回数据，此调用的返回内容未加密，并且由于系统未验证会话授权，攻击者可以复制具有更高权限的用户浏览器内容，从而访问被复制代码的用户所具有的功能。 漏洞类型 访问控制失效 CVSS 分数与攻击向量 基础分数： 7.6 攻击向量： https://www.first.org/cvss/calculator/3.1CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L 漏洞验证：...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - 認可の欠如 説明 WordPress用プラグインYARPP – Yet Another Related Posts Pluginは、バージョン5.30.10までの全バージョンにおいて、/includes/yarppprosetdisplaytypes.phpファイルに能力チェックが欠如しているため、権限のないアクセスに対して脆弱です。これにより、認証されていない攻撃者が表示タイプを設定できる可能性があります。 root@kitploit: Type: plugin CVSS Score: 5.3 CVSS Vector:...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - 認証欠如による機密情報漏洩 説明 「WordPress用Popup by Supsysticプラグインは、バージョン1.10.19以前のすべてのバージョンにおいて、getWpCsvListアクションを介して機密情報漏洩の脆弱性が存在します。これにより、サブスクライバーレベル以上の認証を受けた攻撃者が、購読者のメールアドレスを含む機密データを抽出することが可能となります。」 root@kitploit: reference: -...

CVE-2024-10124

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce = 1.1.1 - 認証欠如による未認証の任意プラグインインストール・有効化 説明 WordPress用プラグインVayu Blocks – Gutenberg Blocks for WordPress &...

CVE-2021-38647-noimages

CVE-2021-38647 又名 "OMIGOD" 一个Zeek包，用于检测CVE-2021-38647（又名OMIGOD）的利用尝试。 https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647 利用...

CVE-2025-1639

🔓 CVE-2025-1639 のエクスプロイトスクリプト 📝 説明 WordPress用Animation Addons for Elementor Proプラグインは、バージョン1.6までの全バージョンにおいて、installelementorpluginhandler...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - 認証欠如：認証済みユーザー（Subscriber以上）による任意のオプション更新 説明 WordPress用プラグインMinterpressは、バージョン1.0.5までのすべてのバージョンにおいて、関数に対する機能チェック（capability...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - 缺少授权导致的任意选项更新 描述 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX WordPress 插件存在由于 'postxpresetscallback' 函数缺少权限检查导致的数据未经授权修改漏洞，影响所有版本至...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - 認可欠如による認証済み（購読者以上）の任意オプション更新 説明 WordPress用プラグインQuietly...

CVE-2026-90552

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints. This missing authorization check allows both authenticated users with canStream privileges and unauthenticated us...

CVE-2026-90551

WWBN AVideo (through commit c3edcc274) has a missing authorization flaw in its video_from_program API endpoint, which fails to validate playlist ownership before returning results. An unauthenticated network attacker can query the endpoint to enumerate private playlist names, owner information, a...

CVE-2026-90550

WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...

CVE-2026-90549

WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...

CVE-2026-90548

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the ImageGallery list.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to retrieve filenames and URLs of password-protected image gall...

CVE-2026-90547

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization flaw in the Bookmark plugin 's getBookmarks.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to query it with a video ID parameter and retrieve cha...

CVE-2026-90545

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) fails to validate video access permissions in the commentAddNew.json.php endpoint. This missing authorization check allows authenticated users to post comments on videos that are password-protected or group-restricted, effecti...

CVE-2026-90546

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the like.json.php endpoint. The application fails to validate video access permissions before processing like requests, allowing any logged-in user to submit likes on password-protected an...

CVE-2026-90544

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers with low privileges can increment view counts and watch-time on videos they cannot acc...