CVE-2023-22074

CVE-2023-22074 CVE-2023-22074 vulnerability in oracle database sharding component 19c,21c,23c https://databasesecurityninja.wordpress.com/2023/10/25/cve-2023-22074-oracle-database-password-hash-exposure-in-sharding-component/...

CVE-2026-45332-PoC

CVE-2026-45332: Automad CMS のアクセス制御の不備 CVE-2026-45332 の概念実証です。Automad CMS のアクセス制御の不備（Broken Access Control）に関する脆弱性で、初期設定後に無効化されることのないセットアップエンドポイントを通じて、認証されていない任意の攻撃者がすべての管理者アカウントの bcrypt パスワードハッシュと TOTP シークレットをダンプできます。 フィールド| 値 ---|--- CVE| CVE-2026-45332 GHSA| GHSA-xm76-r88j-vm3g 製品| Automad CMS...

CVE-2025-65900

CVE-2025-65900: Kalmia CMS v0.2.0 - 不適切なアクセス制御 Incorrect Access Control に対して脆弱です 脆弱性の概要 CVE ID: CVE-2025-65900 製品: DifuseHQ Kalmia CMS 影響を受けるバージョン: 0.2.0 脆弱性の種類: 不適切なアクセス制御 Incorrect Access Control 必要な権限: 低 読み取り専用ユーザーアカウント 影響 この脆弱性により、低権限ユーザーが Blowfish...

PT-2026-91243

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90533

Flowise before 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. Any authenticated organization member can query the endpoint with an arbitrary user ID to retrieve the organization owner's full user record, including the bcrypt password hash ...

CVE-2026-89012

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

EUVD-2026-76141

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-38058

ST Engineering iDirect iQ200 VSAT terminals are affected by an information exposure flaw where an endpoint returns the complete device configuration as JSON, including the SECURITY section containing MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid w...

CVE-2026-88893

OpenPanel 's share lookup procedures fail to validate access controls, allowing unauthenticated callers who possess a share link to retrieve argon2id password hashes and full report configurations (event names, filters, breakdown dimensions). This enables offline password cracking and theft of bu...

PT-2026-89404

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...

LOYTEC L-IP BACnet/IP Routers Exposure of Sensitive Information to an Unauthorized Actor (CVE-2015-7906)

LOYTEC L-IP BACnet/IP router devices allow a remote, unauthenticated attacker to download a device backup file that exposes the hash of the device's user passwords. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

CVE-2026-86190

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

EUVD-2026-72011

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2021-43613

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2026-85155

WWBN AVideo is vulnerable to SQL injection in the sort column parameter of the get.json.php endpoint when APIName=channels. An unauthenticated attacker can order results by arbitrary database columns such as users.password and users.recoverPass, enabling an ordering oracle to infer password hash ...

CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

CVE-2021-43613 SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege...

CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint

Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...

CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...