279 matches found
CVE-2024-32371
CVE-2024-32371 の説明 説明 CVE-2024-32371 として識別された脆弱性により、攻撃者は type パラメータを 1 から 0 に変更することで権限を昇格できます。この脆弱性により、通常のユーザーアカウントを持つ攻撃者が権限を昇格し、システムへの管理者アクセスを取得できます。 対象バージョン: HSC Mailinspector 5.2.17-3 で発見されましたが、5.2.18 までのすべてのバージョンに適用されます。 脆弱なパラメータ パラメータ: type 影響を受ける値: 値 1（通常ユーザー）から 0（管理者）への変更 脆弱性の説明 この脆弱性は、typ...
CVE-2023-22515
レッドチームツール-Confluence未承認管理者ユーザー追加CVE-2023-22515脆弱性悪用ツール 脆弱性の影響範囲 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server = 8.2.3 8.3.0 = Confluence Data Center and Confluence Serv...
CVE-2019-16097
CVE-2019-16097 Harbor 未授权で管理者を作成する脆弱性の原理 docker及びpocpocsuiteフレームワークベース...
CVE-2026-63030
CVE-2026-63030 WordPress REST API の batch ルート混乱 + SQL インジェクション により、未認証での管理者作成 → リモートコード実行 を引き起こす完全な攻撃チェーン PoC。 認可されたセキュリティテスト、脆弱性の再現、研究目的にのみ使用してください。未認可のターゲットへの使用は禁止です。 脆弱性の概要 項目| 説明 ---|--- CVE| CVE-2026-63030 コンポーネント| WordPress Core REST API /batch/v1 影響を受けるバージョン| WordPress 6.9.0 – 6.9.4 、7.0.0...
CVE-2023-3460_POC
CVE-2023-3460 CVE-2023-3460 のエクスプロイト — Ultimate Member プラグインの管理者権限の不正取得。Golang で作成。 ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ 免責事項 ║ ║ プロジェクトについて ║ ║ ║ ║ ║ ║ この概念実証 PoC は教育および研究目的で開発されました。 ║ ║ このエクスプロイトは一部のケースで問題がありました。 ║ ║...
CVE-2026-100623 Capgo Authentication Bypass via Direct PostgREST org_users Table Write
Capgo capgo.app exposes the legacy membership table public.orgusers directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...
EUVD-2026-70667
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
EUVD-2024-55742
A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...
nacos-authscope
Nacos 3.x: Authentication Scope Mismatch Unauthorized Self-Bu...
CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...
CVE-2026-69082
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...
VulnCheck KEV: CVE-2026-73532
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2025-67651
A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...
CVE-2025-67651
The CVE-2025-67651 entry describes a Cross-Site Request Forgery (CSRF) flaw in multiple PHP Jabbers scripts. The root cause is missing CSRF tokens and/or improper SameSite attributes, allowing an attacker to perform actions in an authenticated user’s context, notably creating new admin accounts. ...
CVE-2025-67651
A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...
CVE-2025-67651: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...
PT-2026-66749
Name of the Vulnerable Software and Affected Versions PHP Jabbers scripts affected versions not specified Description A Cross-Site Request Forgery CSRF issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using th...
PT-2026-63432
Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11 Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize...
PT-2026-63353
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens JWTs, ignoring the actual role of the acting user. In environments where the Token...