CVE-2024-11680

ProjectSend CVE-2024-11680 Exploit Ceci est un exploit de preuve de concept pour CVE-2024-11680, une vulnérabilité non authentifiée de modification de configuration et de téléchargement de web shell dans ProjectSend. Description L'exploit profite de multiples vulnérabilités dans ProjectSend :...

WPTaskScheduler_CVE-2024-49039

WPTaskScheduler Persistence и CVE-2024-49039 как часть поверхности атаки в Планировщике задач. WPTaskScheduler.dll является компонентом Планировщика задач, начиная с Windows 10 1507. Это, вероятно, инструмент-бэкдор, используемый для персистентности, который был проанализирован исследователями...

CVE-2022-44721-CsFalconUninstaller

CVE-2022-44721 Crowdstrike Falcon Uninstaller CrowdStrike Falcon est une solution de détection et réponse sur endpoint EDR et antivirus AV basée sur le cloud. Sur chaque terminal, un capteur géré au niveau du noyau est déployé et exploite les capacités cloud. Le capteur peut être configuré avec u...

CVE-2022-1388

CVE-2022-1388 Уязвимость BIG-IP iControl REST CVE-2022-1388 Использование Этот POC проверен! root@kitploit: curl -i -s -k -X $'POST' \ -H $'Host: localhost' -H $'Connection: keep-alive, X-F5-Auth-Token' -H $'Authorization: Basic YWRtaW46' -H $'X-F5-Auth-Token: a' -H $'Content-Length: 39' ...

CVE-2025-63667

CVE-2025-63667 — Preuve de vulnérabilité des caméras IP basées sur Vatilon Nettoyé Résumé Plusieurs caméras IP basées sur Vatilon marques observées : SIMICAM, KEVIEW, ASECAM émettent des jetons Session-Id sans vérifier la validité des identifiants. Cette faille permet à des attaquants non...

CVE-2026-82879

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

CVE-2026-56291

CVE-2026-56291 — Exploit RCE Massif Balbooa Forms Joomla Pré-Auth form.uploadAttachmentFile → Pas de CSRF → Upload PHP Aperçu CVE-2026-56291 est une vulnérabilité critique CVSS 9.8 de téléchargement arbitraire de fichier non authentifié dans l'extension Joomla Balbooa Forms combaforms 2.4.1. La...

Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240

Script de contournement de l'atténuation de force brute Bludit Présentation Ce script est une implémentation Bash remaniée d'un exploit ciblant le CMS Bludit version = 3.9.2. Il exploite une vulnérabilité CVE-2019-17240 qui permet de forcer les mots de passe par brute force en contournant la...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-65633

AshAuthentication (team-alembic) contains an improper authentication flaw where the stateless bearer-token helper retrieve_from_bearer/3 fails to verify that a JWT's purpose claim equals user. When a resource uses the default require_token_presence_for_authentication?: false, purpose-limited toke...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools contains a vulnerability related to bypassing the SAML token signature. A malicious actor who has been granted “Guest Operation Privileges” can potentially elevate their privileges if the target virtual machine has been assigned a more privileged “Guest Alias”. source-iocs-preserved...

CVE-2026-14287

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-14287

The 10Web Booster WordPress plugin (versions before 2.33.5 ) is vulnerable to unauthenticated Stored XSS via Critical CSS Token Bypass . The root cause is a combination of insufficient access token validation on an unauthenticated request handler and failure to escape attacker-supplied stylesheet...

CVE-2026-14287 TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

PT-2026-78281

Name of the Vulnerable Software and Affected Versions User Verification by PickPlugins WordPress plugin versions prior to 2.0.48 Description The plugin fails to verify if a request to resend a verification email is authorized for the specified user and does not bind the protection token to that...

PT-2026-78230

Name of the Vulnerable Software and Affected Versions Tapo C200 version v5 Description An improper authentication issue exists within the login authentication verification module. An attacker on the local network can exploit weaknesses in the validation of the challenge parameter to bypass...

CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...

CVE-2026-67366 Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069

IBM i versions 7.3–7.6 are affected by CVE-2026-17069 due to improper validation of anti-CSRF tokens, enabling a remote authenticated attacker to bypass security restrictions (Impact: C/H; Privileges Required: Low; User Interaction: None). The vulnerability is tied to Digital Certificate Manager ...