10047 matches found
CVE-2026-86724
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-86724
AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a cross-site request forgery (CSRF) vulnerability in plugin/YPTWallet/view/saveBalance.php . The flaw arises because the endpoint relies solely on session cookies without token validation , allowing an attacker to craft a m...
PT-2026-87101
Name of the Vulnerable Software and Affected Versions sso-master version 1.0.0 Description A flaw in the '/cas/login' endpoint allows attackers to authenticate into the application without providing a password by sending a specially crafted POST request. Recommendations At the moment, there is no...
CVE-2026-79577: Improper Access Control
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
EUVD-2026-72363
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...
SUSE CVE-2026-50879
An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...
CVE-2026-79423
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2026-79426
An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-79426
An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-79423
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
PT-2026-86258
An arbitrary file deletion vulnerability in the /adminapi/file/video data save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-85693: Authorization Bypass Through User-Controlled Key
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...
CVE-2026-79426: External Control of File Name or Path
An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-79423: Improper Neutralization of Special Elements used in an OS Command
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...