CVE-2019-16097

CVE-2019-16097 Harbor 비인가 관리자 생성 취약점 원리 docker 및 pocpocsuite 프레임워크 기반...

CVE-2024-32371

Описание CVE-2024-32371 Описание Уязвимость, идентифицированная как CVE-2024-32371, позволяет атакующему повысить привилегии, изменив параметр type с 1 на 0. Эта уязвимость позволяет атакующему с обычной учетной записью пользователя повысить свои привилегии и получить административный доступ к...

CVE-2023-22515

Инструмент Red Team - Эксплуатация уязвимости неавторизованного добавления администратора в Confluence CVE-2023-22515 Затронутые версии root@kitploit: 8.0.0 = Confluence Data Center и Confluence Server = 8.0.4 8.1.0 = Confluence Data Center и Confluence Server = 8.1.4 8.2.0 = Confluence Data Cent...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch 라우트 혼동 + SQL 인젝션 으로 인해 인증 없이 관리자 생성 → 원격 코드 실행 이 가능한 전체 익스플로잇 체인 PoC입니다. 승인된 보안 테스트, 취약점 재현 및 연구용으로만 사용하십시오. 무단 대상에 대한 사용은 금지합니다. 취약점 개요...

CVE-2023-3460_POC

CVE-2023-3460 CVE-2023-3460 익스플로잇 - Ultimate Member 플러그인의 무단 관리자 액세스. Golang으로 제작됨 root@kitploit: ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ 면책 조항 ║ ║ 프로젝트 소개 ║ ║ ║ ║ ║ ║ 이 개념 증명PoC은 교육 및 연구 목적으로만 ║ ║ 이 익스플로잇을 사용할 때 일부 경우 문제가 ║ ║...

CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2025-67651

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67651

The CVE-2025-67651 entry describes a Cross-Site Request Forgery (CSRF) flaw in multiple PHP Jabbers scripts. The root cause is missing CSRF tokens and/or improper SameSite attributes, allowing an attacker to perform actions in an authenticated user’s context, notably creating new admin accounts. ...

PT-2026-66749

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

PT-2026-63432

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...

PT-2026-63353

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens JWTs, ignoring the actual role of the acting user. In environments where the Token...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2026-21760

CVE-2026-21760 affects HCL DevOps Loop with an unauthorized access via forced browsing. The root cause is improper authorization checks that permit direct access to protected admin endpoints. CVSSv3.1 metrics indicate Network attack vector, Low privileges required, User interaction required, with...

CVE-2026-21760

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality Forced Browsing vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints...

EUVD-2026-45086

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...

CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...

CVE-2026-58319

CVE-2026-58319 concerns Apache Doris Frontend (FE) HTTP REST administrative APIs that were reachable without authentication. The available data states an unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially compromis...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the CheckAuth process. An attacker can gain unauthorized administrative access by sending requests from any Chrome or Chromium browser extension, allowing them to exfiltrate data, inject malicious scripts, and...

CVE-2026-33543 FOSSBilling: Authentication bypass allows unauthenticated administrator creation

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already...