CVE-2025-22963

Overview Cross-site request forgeryCSRF vulnerability in Teedy versions = v1.11 allows remote attackers to force an end user to change their user informationusername, password, etc... on the web application in which they're currently authenticated. Vulnerability User information change endpoint i...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

FREEDOM Administration - Default Login

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires ma...

twifo-cli

T W I F O - C L I Get user information of a Twitter user! Install $ npm install --global twifo-cli OR $ sudo npm install --global twifo-cli Usage $ Usage: twifo Example: $ twifo 9gag Related twifo : API for this tool. quorafy: Get user information of a Quora user. License MIT © Rishi Giri...

LinEnum

LinEnum For more information visit www.rebootuser.com Note: Export functionality is currently in the experimental stage. General usage: version 0.982 Example: ./LinEnum.sh -s -k keyword -r report -e /tmp/ -t OPTIONS: -k Enter keyword -e Enter export location -t Include thorough lengthy tests -s...

CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Indico BOLA Vulnerability Discovered and reported a BOLA vulnerability in Indico. 📜 Description CVE-2024-50633 A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive user information by manipulating API...

CVE-2019-13403

CVE-2019-13403 Report: May 2019 Fix: May 2019 Credit: B3Bo1d Description Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information. PoC Before After Reference https://vulners.com/cve/CVE-2019-13403...

CVE-2025-22963

Overview Cross-site request forgeryCSRF vulnerability in Teedy versions = v1.11 allows remote attackers to force an end user to change their user informationusername, password, etc... on the web application in which they're currently authenticated. CVE ID| CVE-2025-22963 ---|--- CWE ID| CWE-352 C...

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...

OpenNebula-CVE-2025-56536

OpenNebula-CVE-2025-56536 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in user information Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept : Fix : Upgrade to...

CVE-2026-100298

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

CVE-2026-100298

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is vulnerable to a flaw where two user-information endpoints can reveal sensitive device and account details . This occurs under conditions not intended for normal operation. While the impact is rated as High for confidentiality, integrity, and avai...

EUVD-2026-89407

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

EUVD-2026-80858

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login toke...

CVE-2026-84586

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information...

Linux Distros Unpatched Vulnerability : CVE-2025-56536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored cross-site scripting XSS vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payloa...

Token Revocation Bypass

Keycloak is vulnerable to a token revocation bypass vulnerability. The vulnerability is due to an application-specific “not-before” token revocation policy being silently ignored when an older, non-zero realm-level policy exists, which allows an attacker to continue using previously issued tokens...

CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

Malicious code in messenger-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo.username, home directory, DNS servers and...