tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

EUVD-2026-90909

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

url-tracker

URL Tracker v0.5.0 URL Tracker is a robust and scalable web application designed to monitor and track URLs, log changes, and provide detailed insights into the status and behavior of various web resources. Built on top of Sails.js, this application is perfect for tracking URLs for uptime, content...

DBScanner

DBScanner Unauthorized access + weak password batch detection Automatically scan common SQL and No-SQL database scripts on the internal network mysql, mssql, oracle, postgresql, redis, mongodb, memcached, elasticsearch, including unauthorized access and common weak password detection Runs in a...

CVE-2024-29855

CVE-2024-29855 Veeam Recovery Orchestrator Authentication Bypass CVE-2024-29855 by Sina Kheirkhah @SinSinology of SummoningTeam @SummoningTeam Technical Analysis A root cause analysis of the vulnerability can be found on my blog Summary Veeam published a CVSS 9 advisory for a authentication bypas...

CVE-2026-56599

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2022-29464

CVE-2022-29464 Introduction Critical WSO2 vulnerability CVE-2022-29464 was found by Orange Tsai. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to submit malicious JSP files to WSO2 servers and get Remote Code Execution RCE. Disclaimer: Educationa...

CVE-2023-29923-Scan

CVE-2023-29923-Scan PowerJob =4.3.2 Unauthorized Access Vulnerability Detection Tool CVE-2023-29922...

CVE-2023-1454-EXP

CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Unauthorized SQL injection vulnerability JeecgBoot is a low-code development platform based on a code generator. The latest unauthorized SQL injection in the Java low-code platform jeecg-bootv3.5.0 for enterprise web applications. In addition to exploiti...

CVE-2022-47130

CVE-2022-47130 Academy LMS history.pushState'', '', '/'...

CVE-2025-68434-OSPOS-CSRF

CVE-2025-68434: CSRF Unauthorized Administrator Creation in OpenSourcePOS Metadata| Details ---|--- CVE ID| CVE-2025-68434 Severity| Critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability Type| Cross-Site Request Forgery CWE-352 Affected Versions| OpenSourcePOS v3.4.0, v3.4.1...

CVE-2025-4162030

Security Advisory: CVE-2025-4162030 This security summary was provided by CoPilot ^1^. The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be...

CVE-2025-60012-POC

For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer CVE-2025-60012 — Apache Livy Unauthorized File Access -yellow Overview Field| Detail ---|--- CVE ID| CVE-2025-60012 Severity| Medium CVSS 6....

foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-56599

HCL BigFix Service Management is impacted by an Insecure Cookie Attribute Configuration vulnerability (CWE-614). The root cause is the absence of essential security attributes, including SameSite , HttpOnly , Secure , and restrictive Paths . This flaw could enable an attacker to perform Cross-Sit...

EUVD-2026-90878

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

ActiveMQ_putshell-CVE-2016-3088

ActiveMQputshell-CVE-2016-3088- ActiveMQputshell directly obtains webshell Usage： python3 ActiveMQputshell.py -u url...

CVE-2025-29927-PoC

CVE-2025-29927 Research and Safe Testing Framework This repository contains research and analysis related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications. ⚠️ Important: This repository is for...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...