CVE-2024-33676

CVE-2024-33676 Weak authentication and authorization on Enel X JuiceBox Level 2 EV charger enables access to operating system functions and parameters. Description Users on the local EV charger WLAN network can extract PII, change settings, and manipulate the operating system file system. This is...

bug-bounty-findings-o-research-disclosures.

bug-bounty-findings-o-research-disclosures. Bug Bounty: CVE-2023-50839 IDOR identificado en un componente de soporte de terceros a través de 'gau' y 'Nuclei'. A pesar de las redirecciones perimetrales, el software desactualizado permaneció expuesto. Confirmado mediante análisis manual de cabecera...

ODBParser

| ODBParser ---|--- TL;DR ODBParser is a tool to search for PII being exposed in open databases. ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance OR to query databases you have permission to access! PLEASE USE RESPONSIBLY What is this? Wrote thi...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

CVE-2023-35078-Exploit-POC

PoC del exploit CVE-2023-35078 La vulnerabilidad de acceso remoto no autenticado a la API CVE-2023-35078 ha sido descubierta en Ivanti Endpoint Manager Mobile EPMM, anteriormente conocido como MobileIron Core. Esta vulnerabilidad afecta a todas las versiones compatibles: versión 11.4, lanzamiento...

vibe-coding-security

Sicurezza del Vibe Coding Prima di twittare il tuo lancio, esegui questi 69 controlli. Corrispondono esattamente ai pattern alla base della CVE RLS di Lovable CVE-2025-48757, 170+ app, 2025, della fuga di Moltbook 1,5 milioni di token API, feb 2026 e della violazione della piattaforma Lovable...

OWASP-Model-Card-Security-Standard

OWASP Model Card Security Standard Status: Entwurf – Inkubierendes OWASP-Projekt Dieser Standard wird aktiv weiterentwickelt. Beiträge und Feedback sind sehr willkommen. Worum geht es hier? Wenn du ein vortrainiertes Modell von HuggingFace oder einem anderen Repository herunterlädst, vertraust du...

CVE-2025-66698

CVE-2025-66698 Software objetivo: Veda Semantic Machines v5.4.8 probablemente todas las versiones anteriores. Tipo de vulnerabilidad: Omisión de autenticación. ID de CVE: CVE-2025-66698. Resumen: El sistema valida incorrectamente el parámetro ticket, tratando una cadena vacía como una sesión...

CVE-2022-0482_exploit

CVE-2022-0482 Vulnerability Exploitation Introduction This document outlines the detailed analysis of CVE-2022-0482, a critical security vulnerability identified in the Easy!Appointments scheduling software. This flaw, related to Incorrect Authorization under CWE-863, allows unauthorized access t...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

GHSA-9RG8-2WVR-FGJH Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

CVE-2026-90899

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

EUVD-2026-85549

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90899

The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com contains an Insecure Direct Object Reference (IDOR) vulnerability. The checkout.searchGuestUser endpoint allows unauthenticated attackers to query guest checkout records using only an email address. Because the server l...

CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-90899: Exposure of Sensitive Information to an Unauthorized Actor

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...