api-scanner-docker

API Scanner - Self-Hosted Deployment API Scanner is an automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specifications and WSDL files. Prerequisites Docker Engine 20.10+ Docker Compose v2 Python 3.6+ for setup script 8 GB RAM minimum 16 G...

Go365

Go365 v2.0 Fixed AWS gateway issues thanks h0useh3ad! No longer dies when proxy server connections fail Added the graph endpoint Please read all of this README before using Go365! Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office36...

MantisBT < 2.28.1 - SOAP API Authentication Bypass

Mantis Bug Tracker 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. id:...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Una vulnerabilidad de extracción de datos no autenticada en impresoras Kyocera, que permite recuperar la libreta de direcciones en texto claro y las contraseñas de dominio. Resumen de la vulnerabilidad A finales de 2021, durante una prueba de penetración, estaba experimentan...

CVE-2020-0618_DETECTION

CVE-2020-0618 - Microsoft SQL Server Reporting Services SSRS RCE Detection PoC 📜 Description This is a simple PoC to detect CVE-2020-0618 , a Remote Code Execution vulnerability affecting Microsoft SQL Server Reporting Services SSRS. The vulnerability exists due to improper path validation in the...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in the crlserver component. An authenticated user with permission to add CRL URLs via BCC , the WSI REST or SOAP API , or the cacrl command-line interface can trigger shell command substitution. This allows the attacker to execute com...

CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

EUVD-2026-90875

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

cve-2023-34960

cve-2023-34960 chamilo soap api rce /webservices/additionalwebservices.php...

PT-2026-103902

Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...

Chamilo Command Injection

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

EUVD-2026-75087

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user holding a valid cookie_string (obtainable from the MANTIS_STRING_COOKIE browser cookie after login) can authenticate as any other user by supplying that cookie_stri...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156: Improper Authentication

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-8339 SQL Injection in Coverity Connect SOAP API

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands...