CVE-2024-24573

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can...

CVE-2024-24767

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. Th...

CVE-2024-4089

A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges...

CVE-2024-8478

The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it...

SuperMicro MBD-X12DPG-OA6 安全漏洞

The SuperMicro MBD-X12DPG-OA6 is a processor from SuperMicro USA. A security vulnerability exists in the Supermicro MBD-X12DPG-OA6. An attacker exploiting this vulnerability could upload a specially crafted image resulting in a stack overflow...

CVE-2025-22681: Missing Authorization

Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Cloner: from n/a through = 1.0.1...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

CVE-2024-57434: Incorrect Authorization

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

PT-2025-3441 · Unknown · Macrozheng Mall-Tiny

Name of the Vulnerable Software and Affected Versions: Macrozheng Mall-Tiny version 1.0.1 Description: The issue is related to incorrect access control. By default, the project imports users, and a test user is granted super administrator privileges. Recommendations: For Macrozheng Mall-Tiny...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

CVE-2024-57434

The Macrozheng Mall-Tiny development scaffolding (version 1.0.1 ) is vulnerable to Incorrect Access Control . The underlying cause is that the project imports users by default, which automatically grants the test user super administrator privileges. Practical consequences include unauthorized adm...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

Malicious code in ember-super-prosemirror (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 258b229e7fc629055a74b829ee28b761e137f5d9ad4345ebec8702b651baf88e Any computer that has this package installed or running should be considered...

MAL-2025-651 Malicious code in ember-super-prosemirror (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 258b229e7fc629055a74b829ee28b761e137f5d9ad4345ebec8702b651baf88e Any computer that has this package installed or running should be considered...

Vulnerability fixed in FortiNet FortiOS and FortiProxy

FortiNet has fixed a vulnerability in FortiOS and FortiProxy. The vulnerability is in the node.js implementation of the management Web interface and allows a malicious person to bypass authentication to become super-admin on the vulnerable system without prior authentication or authorizations. Fo...

About Authentication Bypass – FortiOS (CVE-2024-55591) vulnerability

About Authentication Bypass - FortiOS CVE-2024-55591 vulnerability. A critical flaw allows remote attackers to gain super-admin privileges via crafted requests to the Node.js websocket module. Affected systems include Fortinet devices running FortiOS e.g., FortiGate NGFW and FortiProxy. On Januar...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy

CVE-2024-55591 PoC This repository contains an PoC Proof of...

CVE-2025-24682

Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through = 2.7.9...