the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

Vulnerabilities in Splunk Enterprise

Splunk has identified several vulnerabilities in Splunk Enterprise. These vulnerabilities apply to various versions of Splunk Enterprise and include insufficient authorization checks in REST API endpoints, allowing unauthorized users to access privileged functions or sensitive data. Some of these...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion The plugin does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. Usage: usage: PoC.py -h -u URL -p PAYLOAD Essential Bloc...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - Missing Authorization to Infinite Money Glitch Description The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and U...

cve-2024-56348

JetBrains TeamCity Authentication Bypass + RCE CVE-2024-56348 PoC 📜 Description CVE-2024-56348 is a critical authentication bypass vulnerability in JetBrains TeamCity on-premises affecting all versions prior to 2024.12. The REST API improperly handles requests to paths containing ;.jsp, allowing ...

CVE-2025-6792

Exploit: Unauthorized Pusher Channel Subscription Eavesdropping 1 Obtain Pusher credentials from browser console console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Subscribe to a victim’s private channel Pusher Eavesdrop Test Listening on private-user-5...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability 1. Vulnerability Description Zoho ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...

CVE-2025-5964-

CVE‑2025‑5964 Path Traversal PoC for M‑Files Author: Byte Reaper Telegram: @ByteReaper0 Overview This repository contains a Proof‑of‑Concept PoC in C for a suspected Path Traversal vulnerability in M‑Files version 25.6.14925.0. The PoC file exploit.c attempts to read sensitive files e.g...

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...

CVE-2017-12542-Exploit

HP iLO Authentication Bypass CVE-2017-12542 This repository contains a proof-of-concept exploit for CVE-2017-12542 , an authentication bypass vulnerability affecting certain versions of HP Integrated Lights-Out iLO firmware. The vulnerability allows unauthenticated access to the iLO REST API, whi...

wp-mhn

wp-mhn Integra tu Servidor Modern Honeypot Network y tu Blog de Wordpress mediante la API REST de MHN y los shortcodes de WP. Instalación y uso 1. Descarga wp-mhn como un archivo zip, o clona el repositorio y comprímelo. 2. Edita config.sample.php con la información correspondiente a tu servidor...

CVE-2025-24000-exploit

CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

CVE-2026-60137-and-CVE-2026-63030

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core Pre-Auth RCE lab — khai thác thật, RCE server. WARNING: Lab chạy WordPress VULNERABLE. Không expose ra internet. Cấu trúc . ├── docker-compose.yml Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin ├── exploit/ PoC exploit clone từ GitHub ...

CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...