white-deface

Author WHITE-DEFACE This is a simple tool to automatically deface vulnerable websites. Tutorial video link at last of this page ⚠️ It uses WebDav vulnerability to exploit. This script sends a PUT requests to the websites given in the targets.txt file. Unauthenticated requests will be accepted and...

PT-2026-134918

Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential source URLs in AWS external account credentials. An external account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve subject token sen...

lazyCSRF

LazyCSRF LazyCSRF is a more useful CSRF PoC generator that runs on Burp Suite. No longer maintenance🙇 When I started developing lazyCSRF, I mistakenly thought that the CSRF PoC generator built into Burp Professional could not generate PoC using XHR and did not support PUT requests, etc. I am stil...

CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-22110 Missing authentication check on POST/PUT requests

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting...

CVE-2026-22110

The web server is vulnerable to a missing authentication check on POST and PUT requests. An unauthenticated attacker can exploit this to reboot the charger . Additionally, by brute-forcing the configid , an attacker can set the service password and subsequently modify any system setting. No speci...

PT-2026-133584

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654: devlive-community DataCap: DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-111653

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111645: Authorization Bypass Through User-Controlled Key

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...

zmister2016 MrDoc Authorization Issue Vulnerability

zmister2016 MrDoc versions 1.1.1 and earlier have an authorization issue. This vulnerability stems from the lack of object-level authorization in the ImportLocalDoc API. It may allow authenticated users to modify other users’ documents and projects by sending PUT requests containing arbitrary...

Mattermost authorization issue vulnerabilities

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have an authorization issue vulnerability. This vulnerability stems from the combination of unvalidated guest and...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper authorization in PUT and DELETE requests for the /:lessonId route. Any course member including students can modify the title and stored HTML content of any course, or delete...

EUVD-2026-97891

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-109568: Authorization Bypass Through User-Controlled Key

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-108872 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...