CVE-2025-50904

The WinterChenS my-site personal website, based on springboot 2.0 , is vulnerable to an authentication bypass (CWE-288) in versions through commit 6c79286 (2025-06-11). An attacker can exploit this flaw to gain unauthorized access to the /admin/ API without providing a required token. Practical c...

PT-2025-34134 · Winterchens · My-Site

Name of the Vulnerable Software and Affected Versions: WinterChenS my-site versions through commit 6c79286 2025-06-11 Description: An authentication bypass allows unauthorized access to the /admin/ API without a token. Recommendations: Versions prior to commit 6c79286 2025-06-11 should be updated...

CVE-2024-1221

This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF...

PT-2023-2843 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.15 through 9.0 Description: An open redirect issue exists in the /preauth Servlet, allowing an attacker to redirect a user to any URL if URL sanitization is bypassed in incoming requests. To exploit thi...

GHSA-449W-C77C-VMF6 Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

PT-2022-5837 · Jenkins · Jenkins Git Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Git Plugin versions 4.11.3 and earlier Description: The webhook endpoint in Jenkins Git Plugin provides unauthenticated attackers with information about the existence of jobs configured to use an attacker-specified Git repository. Thi...

CVE-2021-35491

A Cross-Site Request Forgery CSRF vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolv...

Cross-Site Request Forgery (CSRF) in bigprof-software/online-invoicing-system

✍️ Description The app/admin/pageDeleteGroup.php?groupID= does not have a CSRF protection. This could be used by attackers to trick the admin to delete a group from their invoice system. 🕵️‍♂️ Proof of Concept For this attack to work, a logged in admin, should visit the POC page...

PT-2021-11621 · Mediawiki +1 · Mediawiki Push Extension +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Push extension versions through 1.35 Description: The issue concerns a lack of required edit token in the API of the Push extension for MediaWiki, specifically in ApiPushBase.php. This omission facilitates a CSRF attack...

PT-2019-13441

Name of the Vulnerable Software and Affected Versions Mirumee Saleor versions prior to 2.8.0 Description The issue concerns the accidental disabling of CSRF protection middleware, allowing attackers to send a POST request without a valid CSRF token. This enables the server to accept such requests...

DEBIAN-CVE-2018-1086

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /runpcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to...