EUVD-2026-77124

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2024-42327

CVE-2024-42327 / ZBX-25623 的 PoC 在 Zabbix 前端中，拥有默认 User 角色或任何其他具有 API 访问权限角色的非管理员用户帐户都可以利用此漏洞。在 CUser 类的 addRelatedObjects 函数中存在一个 SQLi 漏洞，该函数由 CUser.get 函数调用，而 CUser.get 函数对每个具有 API 访问权限的用户都可用。 免责声明 此脚本仅用于教育目的！ 概念验证 以下来自 6.0.31 版本的代码存在 SQLi 漏洞： root@kitploit: $dbroles = DBselect 'SELECT...

dir-3040_dos

dir-3040 拒绝服务 Dir-3060 也可能受影响，因为它们共享来自同一固件的许多组件。 已在最新固件 1.20b03a 热修复版上测试。 FTP 服务器用户访问页面默认配置为允许任何具有写入权限的用户直接写入 RAM，而非仅限制写入 USB 驱动器。 在此问题的固件最新版本中，没有进行越界或缓冲区溢出检查。 写入（填满）可用内存后，系统将崩溃并重启。 用户无需管理员权限即可执行攻击。 以下为带有图片的详细概念验证。 曾联系 D-Link，但他们因无法复现该问题而强烈否认存在该漏洞。其他不合逻辑的解决方案已被我拒绝。 显示新用户的默认配置 检查 syslog 中的可用内存 使用 ...

PyNightmare

PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM fully written in python3 说明 CVE-2021-36934 是 @jonasLyk 发现的一个近期漏洞，允许非管理员用户复制所有注册表配置单元（包含非常私密的信息，如哈希），这可能导致权限提升。 灵感 受 @GossiTheDog 启发的 HiveNightmare 漏洞的简单 PoC。 适用范围 适用于所有启用了系统保护的 Windows 10 版本。 这个PoC有什么作用？ 该利用程序将遍历卷影副本以提取 SAM 和 System...

CVE-2024-42327

CVE-2024-42327 / ZBX-25623 的 PoC 与漏洞利用 在 Zabbix 前端中，具有默认 User 角色或任何其他拥有 API 访问权限的角色的非管理员用户帐户，均可利用此漏洞。CUser 类的 addRelatedObjects 函数中存在一处 SQL 注入漏洞，该函数由 CUser.get 函数调用，而 CUser.get 函数可供每个具有 API 访问权限的用户使用。 受影响版本： 6.0.0 - 6.0.31, 6.4.0 - 6.4.16 , 7.0.0 已修复版本：6.0.32rc1 , 6.4.17rc1, 7.0.1rc1 漏洞代码...

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred ESTE \space EXPLOIT \space PUEDE \space VIOLAR \space LA \space LEY.$$ $$\colorred\space USTED \space ES \space RESPONSABLE \space DE \space SUS \space ACCIONES.$$ $$\colorredSOLO \space CON \space FINES \space DE \space DEMOSTRACIÓN.$$ DESCRIPCIÓN RCE por usuarios no...

CVE-2021-42562

CVE-2021-42562: MITRE Caldera 中的不当访问控制 Caldera（版本 = 2.8.1）未能正确隔离用户权限，导致非管理员用户能够访问、读取和修改本应仅供管理员访问的配置或其他组件。 供应商披露： 此漏洞的供应商披露可在此处找到。 要求： 此漏洞需要： 有效的非管理员用户凭据 概念验证： 更多详细信息和利用过程可在此 PDF 中找到。 其他资源： 此漏洞允许非管理员用户在 MITRE Caldera 中利用漏洞 CVE-2021-42559：在 MITRE Caldera 中通过配置进行命令注入 以实现远程代码执行。...

CVE-2026-81941 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

EUVD-2026-75257

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-87998 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...

EUVD-2026-74937

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

PT-2026-89175

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Falta de autorización en los endpoints de plugins de Docker → RCE en el host Prueba de concepto de CVE-2026-44848 , una vulnerabilidad de falta de autenticación CWE-862 en Portainer que permite a un usuario no administrador con acceso al endpoint de Docker realizar...

POC-CVE-2026-19626

CVE-2026-19626 — RCE en la generación de informes autenticado, no administrador Estado: CONFIRMADO — totalmente remoto, no administrador, solo REST laboratorio 6.7.2-14.el9, 2026-08-21. La cadena armada esto es lo que hace poc.py: 1. inicia sesión como cualquier usuario normal de la organización ...

Linux Distros Unpatched Vulnerability : CVE-2026-86090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

EUVD-2026-71777

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

AZL-99690 CVE-2026-86090 affecting package ntopng 5.2.1-6

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...