permission-manager

Gestor de permisos ¡Bienvenido al Permission Manager! 🎉 🎉 Permission Manager es una aplicación desarrollada por SIGHUP que permite una gestión RBAC para Kubernetes súper fácil e intuitiva. Si buscas una forma sencilla e intuitiva de gestionar tus usuarios dentro de un clúster de Kubernetes, este ...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF a Escalada de Privilegios Tabla de Contenidos Descripción General Detalles de la Vulnerabilidad Software Afectado Puntuación CVSS Escenario de Ataque Prueba de Concepto PoC Pasos para Reproducir Impacto Remediación Referencias Aviso Legal Descripción...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

CVE-2023-33409

CVE-2023-33409 Minical 1.0.0 es vulnerable a Cross-Site Request Forgery. Proveedor: https://github.com/minical/minical Aplicación de demostración: https://demo.minical.io/ PoC La aplicación no tiene ninguna protección CSRF, por lo que una solicitud HTTP especialmente diseñada puede usarse para,...

CVE-2023-49543

CVE-2023-49543 Book Store Management System v1.0 - Control de Acceso Incorrecto Descripción : El control de acceso incorrecto en Book Store Management System v1 permite a los atacantes acceder a páginas no autorizadas y ejecutar funciones administrativas sin autenticarse. Versión del producto...

kratos

Chat · Discusiones · Boletín informativo · Documentación · Probar Ory Network · Empleos Ory Kratos es un sistema de gestión de identidad y usuarios API-first para aplicaciones nativas de la nube. Centraliza los flujos de inicio de sesión, registro, recuperación, verificación y gestión de perfiles...

CVE-2020-24028

CVE-2020-24028 Description ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Insecu...

CVE-2024-52302

CVE-2024-52302: Vulnerabilidad de Carga de Archivos sin Restricciones en Common-User-Management Resumen Descubrí una vulnerabilidad de seguridad crítica en common-user-management , una robusta aplicación Spring Boot que ofrece servicios de gestión de usuarios diseñados para controlar el acceso de...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

CVE-2025-25967

CVE-2025-25967: 사이트 간 요청 위조CSRF DDSN Interactive cm3 Acora CMS 버전 10.1.1은 사이트 간 요청 위조CSRF에 취약합니다. 이 결함으로 인해 공격자는 외부 콘텐츠에 악의적인 요청을 삽입하여 인증된 사용자가 계정 삭제 또는 사용자 생성과 같은 승인되지 않은 작업을 수행하도록 속일 수 있습니다. CSRF 보호 기능이 없기 때문에 피해자의 활성 세션을 활용하는 조작된 요청을 통해 악용이 가능하며, 권한 오용 및 사용자 관리 기능의 잠재적 중단을 초래합니다. 영향받는 버전: Acor...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Control de Acceso Incorrecto Descripción : El control de acceso incorrecto en Customer Support System v1 permite que usuarios no administradores accedan a páginas administrativas y ejecuten acciones reservadas para administradores. Versión del Producto...

CS-Remote-OPs-BOF

Remote Operations BOF 이 저장소는 이전에 공개한 SA 저장소에 추가로 제공되는 것입니다. 당초 저희 입장은 다른 시스템을 수정하는 도구를 공개하지 않는다는 것이었으며, 정보 수집 도구만 바로 사용 가능한 형태로 제공하는 것이었습니다. 시간이 지나면서 다른 많은 공개 보안 업체들이 공격용 도구를 공개하는 것을 보아 왔으며, 이제 저희도 공격용 도구의 일부를 공개하는 것이 적절하다고 판단했습니다. 이 저장소에는 특별히 대단한 것은 없으며, BOF 형태로 구현된 기본적인 Microsoft Windows 작업들입니다...

CVE-2023-37596

CVE-2023-37596 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Eliminar Cualquier Usuario Severidad: Alta | CVSS v3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | CWE: CWE-352 Tabla de Contenidos Resumen Detalles de la Vulnerabilidad Impacto Versión Afectada Escenario de Ataque Prueba de...

EUVD-2026-75572

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88959

Anchor CMS through 0.12.7 contains a privilege escalation vulnerability caused by missing role-based access control (RBAC) on admin user-management endpoints. Any authenticated user with editor or user roles can send POST requests directly to the admin/users/add or admin/users/edit endpoints to c...

CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-29598

CVE-2026-29598: Stored Cross-Site Scripting XSS in cm3 Acora CMS version 10.7.1. DDSN Interactive cm3 Acora CMS version 10.7.1 contains a Stored Cross-Site Scripting XSS vulnerability in the user management functionality. An administrator with the ability to add or edit user details can...

CVE-2026-79387-PbootCMS-SQL-Injection

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Management Module Overview Field| Detail ---|--- CVE ID| CVE-2026-79387 Product| PbootCMS Affected Versions| 3.2.0 – 3.2.5, and possibly earlier Vulnerability Type| SQL Injection CWE-89 Attack Vector| Remote Authenticated CVSS Severity| High...