489 matches found
CVE-2023-29084
CVE-2023-29084 حقن أوامر في ManageEngine ADManager Plus إثبات المفهوم POST /api/json/admin/saveServerSettings HTTP/1.1 Host: 10.10.10.99:8080 Content-Length: 183 Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x...
Payload didn't enforce field-level password update restrictions
Impact When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...
GHSA-FX49-4H83-WJV9 Payload didn't enforce field-level password update restrictions
Impact When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...
CVE-2026-105855 Payload: Field-level password update restrictions were not enforced
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions...
CVE-2026-105855
The Payload headless content management system contains a vulnerability in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . The server fails to correctly enforce field-level access.update restrictions on the password field within an authentication collection. This improper acce...
EUVD-2026-93499
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions...
CVE-2026-105855 Payload: Field-level password update restrictions were not enforced
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions...
PT-2026-106788
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Description The server fails to correctly enforce a field-level access.update restriction on the password field within an authentication collection. This allows the...
CVE-2017-14980_syncbreeze_10.0.28_bof
استغلال - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 يحتوي هذا المستودع على استغلال تجاوز سعة المخزن المؤقت BOF كدليل على المفهوم لـ Sync Breeze Enterprise الإصدار 10.0.28، ويستهدف الثغرة المعروفة باسم CVE-2017-14980. الوصف توجد الثغرة بسبب التحقق غير السليم من الإدخال عند معالجة حقل passwo...
CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user
CMSmadesimple XSS المنعكسة v2.2.18 المؤلف: Sergio الوصف: تتيح ثغرات متعددة لتنفيذ البرمجة النصية عبر المواقع XSS في ملف install/adduser.php في CMSmadesimple الإصدار v2.2.18 لمهاجم محلي تنفيذ تعليمات برمجية عشوائية عبر سكربت مصمم خصيصًا لحقنه في حقلَي كلمة المرور وإعادة كلمة المرور في قسم "My...
CVE-2026-88280
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...
CVE-2026-88280 GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...
CVE-2026-88280 GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
CVE-2026-36851: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
EUVD-2026-66662
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
CVE-2026-36851
UnPoller version 2.33.0 is vulnerable to a path traversal vulnerability in the password field. The application fails to perform path checks when a password starts with the file:// prefix, causing it to read arbitrary files from the local disk via os.ReadFile() in pkg/inputunifi/input.go. An attac...
PT-2026-82244
Name of the Vulnerable Software and Affected Versions UnPoller version 2.33.0 Description A path traversal issue exists in the password field, which allows an attacker to read arbitrary files and perform network exfiltration. Path traversal is a technique used to access files and directories that...