pfsense-config-readonly-restore

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-config-readonly-restore pfsense-config-readonly-restore Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org writeconfig honors user-config-readonly. configinstall and...

pfsense-api-unix-sock-noauth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-api-unix-sock-noauth pfsense-api-unix-sock-noauth Class: Privilege leftover Reach: Local pfSense Plus MIM API b4acd7ca - Netgate github.com/Netgate/pfsense-api is the public OpenAPI plus generated Python for...

pfsense-ldap-name-collision

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ldap-name-collision pfsense-ldap-name-collision Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org getUserEntry$name returns the local row on name match. isAdminUID then...

pfsense-wizard-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-wizard-uid0 pfsense-wizard-uid0 Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org wizard.php?xml=setupwizard.xml step 7 getUserEntryByUID0 plus localusersetpassword...

pfsense-api-fleet-jwt

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-api-fleet-jwt pfsense-api-fleet-jwt Class: IDOR Reach: Remote pfSense Plus MIM API Netgate pin b4acd7ca - github.com/Netgate/pfsense-api One POST /login Bearer is reused for every enrolled deviceid. Official...

mysql-set-role-leftover

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · mysql-set-role-leftover Write-up: https://abraxaslabs.tech/research/mysql-set-role-leftover mysql-set-role-leftover Class: Privilege leftover FILE as mysqld UID; not OS LPE Reach: Remote MySQL Community Server mysqld...

signal-server-dropwizard-admin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · signal-server-dropwizard-admin Write-up: https://abraxaslabs.tech/research/signal-server-dropwizard-admin signal-server-dropwizard-admin Class: Privilege leftover Reach: Remote Signal-Server v20261007.0.0 a15d5cd -...

openmeetings-stale-install-admin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-stale-install-admin Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-stale-install-admin Class: Privilege leftover Reach: Remote Apache OpenMeetings 9.1.0 9773c59e -...

superset-g3-v0-import-sql-plant

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · superset-g3-v0-import-sql-plant superset-g3-v0-import-sql-plant A coworker with a normal dashboard-editor account can hide their own database query inside a chart other people already trust. The next time anyone opens...

vsftpd-cmds-denied-alias

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-cmds-denied-alias Write-up: https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias vsftpd-cmds-denied-alias Class: Privilege leftover Reach: Remote vsftpd 3.0.5 - Chris Evans I pinned the official tarball,...

vsftpd-ssl-data-any-ticket

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-ssl-data-any-ticket Write-up: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket vsftpd-ssl-data-any-ticket Class: Privilege leftover Reach: Remote vsftpd 3.0.5 Chris Evans - official tarball SHA-256...

spark-proxyuser-classpath

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-proxyuser-classpath Write-up: https://abraxaslabs.tech/research/spark-proxyuser-classpath spark-proxyuser-classpath Class: Privilege leftover leftover of CVE-2023-22946 / SPARK-41958 Reach: Remote Apache Spark...

openmeetings-soap-user-rights

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-soap-user-rights Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-soap-user-rights Class: Privilege leftover Reach: Remote Apache OpenMeetings 9.1.0. SOAP POST /user/...

proftpd-sftp-copy-file-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · proftpd-sftp-copy-file-write Write-up: https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write proftpd-sftp-copy-file-write Class: Privilege leftover / File write Reach: Remote ProFTPD 1.3.9d f59f248 -...

phpmyadmin-config-set-2fa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-config-set-2fa Write-up: https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa phpmyadmin-config-set-2fa Class: Privilege leftover / missing step-up Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e...

opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 Write-up: https://abraxaslabs.tech/research/opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.or...

spark-python-ds-static

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-python-ds-static Write-up: https://abraxaslabs.tech/research/spark-python-ds-static spark-python-ds-static Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...

openlitespeed-dup-cookie-litespeed-role

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openlitespeed-dup-cookie-litespeed-role Write-up: https://abraxaslabs.tech/research/openlitespeed-dup-cookie-litespeed-role openlitespeed-dup-cookie-litespeed-role Class: Privilege leftover Reach: Remote OpenLiteSpeed...

grafana-signup-invite-join

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · grafana-signup-invite-join Write-up: https://abraxaslabs.tech/research/grafana-signup-invite-join grafana-signup-invite-join Class: Privilege leftover Reach: Remote Grafana OSS 13.2.3 6193dc0 - Grafana Labs When...

sqlite-xfer-auth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-xfer-auth Write-up: https://abraxaslabs.tech/research/sqlite-xfer-auth sqlite-xfer-auth Class: Privilege leftover Reach: Local SQLite 3.53.4 b09c88c, SOURCEID 2026-07-24 19:02:57...