CVE-2016-3088

CVE-2016-3088 Apache ActiveMQ Remote Code Execution Exploit Description The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Author Alexandre Aguiar @cyberaguiar Exploit...

CVE-2025-24813-POC

JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...

CVE-2026-111908

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq...

CVE-2026-111888

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

EUVD-2026-103312

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq...

CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq...

CVE-2026-111908

The phpMyFAQ software (versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta ) is vulnerable to a broken object-level authorization (BOLA) flaw in the PUT /api/v3.1/faq/update endpoint. The root cause is that the application verifies the global edit_faq permission but fails to validate if...

EUVD-2026-103331

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

CVE-2026-111888 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

CVE-2026-111888

The phpMyFAQ software (versions 4.0.0 before 4.1.9 ) is vulnerable to an incorrect authorization flaw in the news update API. The root cause is that the PUT /admin/api/news/update endpoint incorrectly validates the NEWS_DELETE permission instead of the required NEWS_EDIT right. Consequently, dele...

CVE-2026-111888 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

CVE-2017-12615

curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...

CVE-2017-12615-Home-Lab

ENGLISH BELOW CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload Lab นี้จำลองช่องโหว่ CVE-2017-12615 Tomcat: Remote Code Execution via JSP Upload เกิดจากการตั้งค่า readonly=false ทำให้สามารถอัปโหลดไฟล์ผ่าน HTTP PUT ได้ รวมถึงไฟล์ .jsp ที่สามารถรันคำสั่ง RCE Features Apache Tomcat 7.0.79...

lazyCSRF

LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...

CVE-2026-111653

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

EUVD-2026-103075

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653

The 53AIHub application (versions through 0.5.3 ) is vulnerable to a missing authentication flaw in the /api/enterprises/:id endpoint. The root cause is that the UpdateEnterprise function only enforces authentication checks when the IS_SAAS flag is true. Consequently, unauthenticated attackers ca...

CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...

CVE-2026-111626

The Webreaper Damselfly software (through version 4.5.3 ) is vulnerable to an authentication bypass because controller authorization attributes are commented out. This flaw allows unauthenticated attackers to access all */api/ routes. By sending a PUT /api/users request with Admin roles, an attac...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...