ODBParser

| ODBParser ---|--- TL;DR ODBParser is a tool to search for PII being exposed in open databases. ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance OR to query databases you have permission to access! PLEASE USE RESPONSIBLY What is this? Wrote thi...

CVE-2024-33676

CVE-2024-33676 Weak authentication and authorization on Enel X JuiceBox Level 2 EV charger enables access to operating system functions and parameters. Description Users on the local EV charger WLAN network can extract PII, change settings, and manipulate the operating system file system. This is...

bug-bounty-findings-o-research-disclosures.

bug-bounty-findings-o-research-disclosures. Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated software remained exposed. Confirmed through manual header analysis. Severity: 5.3 Medium. Focused on Defense...

CVE-2026-1255

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

CVE-2023-35078-Exploit-POC

CVE-2023-35078 Exploit POC CVE-2023-35078 Remote Unauthenticated API Access vulnerability has been discovered in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron Core. This vulnerability impacts all supported versions – Version 11.4 releases 11.10, 11.9 and 11.8. Older...

vibe-coding-security

Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...

OWASP-Model-Card-Security-Standard

Status: Draft — Incubating OWASP Project This standard is under active development. Contributions and feedback are very welcome. What is this? When you download a pre-trained model from HuggingFace or any other repository, you're essentially trusting a black box. You don't know what data it was...

EUVD-2026-81277

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2026-92577 AVideo through 29.0 API get_api_video Broken Access Control via clean_title

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2025-66698

CVE-2025-66698 Target Software: Veda Semantic Machines v5.4.8 likely all prior versions. Vulnerability Type: Authentication Bypass. CVE ID: CVE-2025-66698. Summary: System improperly validates the ticket parameter, treating an empty string as a valid session. Project Link: Veda Semantic Machines...

CVE-2026-88065

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-88065

tts-be is a backend service for a university timetable selector application. Versions prior to 2.1.0 contain a Broken Access Control vulnerability affecting multiple API endpoints, including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata. By chaining these unauthenticated end...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2022-0482_exploit

CVE-2022-0482 Vulnerability Exploitation Introduction This document outlines the detailed analysis of CVE-2022-0482, a critical security vulnerability identified in the Easy!Appointments scheduling software. This flaw, related to Incorrect Authorization under CWE-863, allows unauthorized access t...

CVE-2026-19439

CVE-2026-19439 affects the Ultimate Gift Cards for WooCommerce WordPress plugin (versions 3.0.3 through 3.2.9 ). The root cause is a missing authorisation check in the wps_uwgc_report_details endpoint, which allows unauthenticated users to retrieve gift cards attached to arbitrary orders. This di...

PT-2026-89401

🚨 CVE-2026-88890 OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root...

CVE-2026-78216

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

CVE-2026-78216

AshLua (an Elixir library exposing Ash read actions to Lua scripts via an eval action) contains a field-policy bypass in its aggregate read operations (list, min, max, first, sum, avg). Ash field policies redact forbidden fields on returned records, but that redaction does not apply to aggregate ...