CVE-2025-15602-PoC

CVE-2025-15602-PoC CVE-2025-15602-PoC는 Snipe-IT의 취약점 CVE-2025-15602에 대한 개념 증명입니다. 모든 사용자를 나열하는 하나의 스크립트와 슈퍼관리자 계정을 탈취하는 하나의 스크립트로 구성됩니다. 배경 사용자가 사용자 편집 권한만 가지고 있을 때, 이를 악용하여 모든 사용자를 나열하고 슈퍼관리자 계정을 탈취할 수 있습니다. listusers.py 스크립트에서 BASEURL을 자신의 snipe-it 인스턴스에 맞게 변경하는 것을 잊지 마세요. 인스턴스에서 모든 사용자를 나열하여,...

CVE-2026-35671

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to...

CVE-2026-23480

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided...

CVE-2026-23480

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided...

CVE-2026-23480: Authentication Bypass Using an Alternate Path or Channel

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided...