CVE-2021-24655

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

Authorization

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of...

CVE-2022-27910

creationtimestamp| type| source ---|---|--- 2022-07-11 00:18:34+00:00| seen| https://t.me/cibsecurity/45871...

U.S. Dept Of Defense: Account takeover on ███████ [HtUS]

Hello, I have found an endpoint in ████████ is vulnerable to Account takeover Steps to reproduce: 1. Create 2 accounts Attacker A and vicitm B 2. Log in to all of them and go to https://███████/███████/EditUserProfile with attacker's account 3. Now fill out the password with your password 4. Chan...

CVE-2020-12418

creationtimestamp| type| source ---|---|--- 2022-07-04 18:17:56+00:00| seen| https://t.me/CyberSecurityTechnologies/1479 2026-09-01 17:01:14+00:00| seen| https://t.me/cissp/1246 2026-09-02 01:05:03+00:00| seen| https://t.me/cissp/1246 2026-09-12 02:00:05+00:00| seen| https://t.me/cissp/1246...

CVE-2022-33912

A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery enterprise editions only were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the us...

CVE-2019-12355

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dlsprint.php when the attacker has dlsprint authority via the id parameter...

CVE-2022-30229

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...

CVE-2022-1997

creationtimestamp| type| source ---|---|--- 2022-06-08 18:32:39+00:00| seen| https://t.me/cibsecurity/44035...

CVE-2022-30833

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientedit.php?booking=31&userid=...

CVE-2022-30833

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientedit.php?booking=31&userid=...

CVE-2022-30834

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientmanageaccountdetails.php?bookingid=31&userid=...

CVE-2022-30832

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientassign.php?booking=31&userid=...

CVE-2022-30834

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientmanageaccountdetails.php?bookingid=31&userid=...

GHSA-7HWR-F745-5RWQ MediaWiki information disclosure

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup...

MediaWiki information disclosure

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup...

GHSA-RPC6-H455-3RX5 Celery local privilege escalation vulnerability

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryddetach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving...

CVE-2022-30407

Pharmacy Sales And Inventory System v1.0 is vulnerable to SQL Injection via /pharmacy-sales-and-inventory-system/manageuser.php?id=...

CVE-2022-30400

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/admin/orders/vieworder.php?view=user&id=...

Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...