CVE-2023-33409

CVE-2023-33409 Minical 1.0.0 is vulnerable to Cross-Site Request Forgery. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC The application does not have any CSRF protection, hence a specially crafted HTTP request can be used to, Add New User Delete Existin...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

CVE-2020-24028

CVE-2020-24028 Description ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Insecu...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

CVE-2026-29598

CVE-2026-29598: Stored Cross-Site Scripting XSS in cm3 Acora CMS version 10.7.1. DDSN Interactive cm3 Acora CMS version 10.7.1 contains a Stored Cross-Site Scripting XSS vulnerability in the user management functionality. An administrator with the ability to add or edit user details can...

CS-Remote-OPs-BOF

Remote Operations BOF This repo serves as an addition to our previously released SA repo. Our original stance was that we would not release our tooling that modified other systems, and we would only provide information gathering tooling in a ready to go format. Over time, we have seen many other...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

CVE-2024-52302

CVE-2024-52302: Unrestricted File Upload Vulnerability in Common-User-Management Overview I discovered a critical security vulnerability in common-user-management , a robust Spring Boot application featuring user management services designed to control user access dynamically. This vulnerability...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF to Privilege Escalation Table of Contents Overview Vulnerability Details Affected Software CVSS Score Attack Scenario Proof of Concept PoC Steps to Reproduce Impact Remediation References Disclaimer Overview CVE-2023-34839 is a Cross-Site Request Forgery...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Incorrect Access Control Description : Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators. Vulnerable Product Version : Customer Support...

CVE-2023-49543

CVE-2023-49543 Book Store Management System v1.0 - Incorrect Access Control Description : Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating. Vulnerable Product Version : Book Store...

CVE-2026-79387-PbootCMS-SQL-Injection

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Management Module Overview Field| Detail ---|--- CVE ID| CVE-2026-79387 Product| PbootCMS Affected Versions| 3.2.0 – 3.2.5, and possibly earlier Vulnerability Type| SQL Injection CWE-89 Attack Vector| Remote Authenticated CVSS Severity| High...

CVE-2023-37596

CVE-2023-37596 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete Any User Severity: High | CVSS v3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | CWE: CWE-352 Table of Contents Overview Vulnerability Details Impact Affected Version Attack Scenario Proof of Concept Steps to Reproduce...

CVE-2025-25967

CVE-2025-25967: Cross-Site Request Forgery CSRF DDSN Interactive cm3 Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery CSRF. This flaw enables attackers to trick authenticated users into performing unauthorised actions, such as account deletion or user creation, by embedding...

CVE-2020-24028

CVE-2020-24028 Description ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Insecu...

Linux Distros Unpatched Vulnerability : CVE-2026-92539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same...

CVE-2026-92539

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management SCIM API. This allows an authorized...

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

EUVD-2026-105187

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-111708

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...