kentico-xperience13-AuthBypass-wt-2025-0011

WT-2025-0011 CVE ainda não atribuído Kentico Xperience 13 CMS - Verificação de Bypass de Autenticação do Staging Service Detecção em Ação root@kitploit: python3 .\watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0011.py -H http://labcms -u admin / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ ...

CVE-2023-49496_PoC

CVE-2023-49496PoC Descrizione UCServer è un avanzato server di comunicazione unificata. UCServer di Shanghai Shupin Information Technology Co., Ltd. presenta una vulnerabilità di SQL injection. Un utente malintenzionato può sfruttare questa vulnerabilità per ottenere informazioni sensibili dal...

CVE-2019-14223

CVE-2019-14223: Открытое перенаправление в Alfresco Share Приложение Alfresco Share уязвимо к атаке через открытое перенаправление Open Redirect с помощью специально сформированного POST-запроса. Манипулируя параметром «failure», злоумышленник может перенаправить жертву на вредоносный веб-сайт по...

CVE-2025-11077

CVE-2025-11077 - SQL Injection Autor: Byte Reaper Beschreibung Diese Schwachstelle ist eine Blind-SQL-Injection in der Datei addcontent.php des Online Learning Management Systems CVE-2025-11077, die es einem Angreifer ermöglicht, Datenbankinformationen durch das Senden präparierter POST-Anfragen ...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF Contournamento delle richieste POST Imperva Cloud WAF era vulnerabile a un bypass che permette agli attaccanti di eludere le regole WAF quando inviano payload HTTP POST dannosi, come exploit log4j, SQL injection, esecuzione di comandi, directory traversal, XXE...

CVE-2025-57310

CVE-2025-57310 Eine Cross-Site Request Forgery CSRF-Schwachstelle in Salmen2/Simple-Faucet-Script v1.07 über eine manipulierte POST-Anfrage an admin.php?p=ads&c=1, die es Angreifern ermöglicht, beliebigen Code auszuführen. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Basis-Score: 8.8 Ho...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC Un proof-of-concept dell'exploit per CVE-2025-55182, una vulnerabilità critica di Remote Code Execution nelle applicazioni Next.js che utilizzano React Server Components. ⚠️ DISCLAIMER QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA EDUCATIVI E AUTORIZZATI. ❌...

Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting

Nagios-Log-Server-2.1.7-Cross-Site-Scripting-Persistente Una cross-site scripting persistente XSS in Nagios Log Server 2.1.7 può consentire a un attaccante di eseguire azioni dannose sugli utenti che aprono un link appositamente creato o una pagina web di terze parti. Nagios Log Server 2.1.7 e le...

CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-73197 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

Linux Distros Unpatched Vulnerability : CVE-2026-73197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the...

CVE-2024-42008-9-exploit

CVE-2024-42008-9-exploit Die Skripte in diesem Repository wurden entwickelt, um CVE-2024-42008 und CVE-2024-42009 auszunutzen. Beide CVEs sind Schwachstellen, die in Roundcube 1.6.7 gefunden wurden. Lesen Sie mehr über diese CVEs und wie sie ausgenutzt werden können unter dem folgenden Link:...

CVE-2024-40498

CVE-2024-40498 Aplicação Afetada online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Descrição O arquivo register.php lida com o registro de usuários. Na linha 117, os parâmetros POST "$address1" e "$address2" não são sanitizados, ao contrário do...

next: Next.js: Information disclosure via server-side fetch cache

A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different body. This could lead to the unauthorized disclosure of...

CVE-2026-69115

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-18277 Missing Authorization in eScriptorium

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-15991 File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...