Inventio Lite 4 - SQL Injection

Exploit Title: Inventio Lite 4 - SQL Injection Error Based SQLi in "username" parameter on "/?action=processlogin." Date: 08/21/2024 Exploit Author: pointedsec Vendor Homepage: http://evilnapsis.com Software Link: https://github.com/evilnapsis/inventio-lite Version: ' or email LIKE '' and passwor...

CVE-2025-27927

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...

CVE-2025-30254

An unauthenticated attacker can obtain a serial number of a smart meters using its owner's username...

CVE-2025-27568

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...

CVE-2025-24487

An unauthenticated attacker can infer the existence of usernames in the system by querying an API...

CVE-2025-31941

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...

CVE-2025-31357

An unauthenticated attacker can obtain a user's plant list by knowing the username...

CVE-2024-11084

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists...

Usermin 2.100 - Username Enumeration

Exploit Title: Usermin 2.100 - Username Enumeration Date: 10.02.2024 Exploit Author: Kjesper Vendor Homepage: https://www.webmin.com/usermin.html Software Link: https://github.com/webmin/usermin Version: = 2.100 Tested on: Kali Linux CVE: CVE-2024-44762...

CVE-2025-27927

An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...

CVE-2025-27927

CVE-2025-27927 concerns Growatt Cloud Applications (Growatt Cloud portal). Connected sources describe a vulnerability where an unauthenticated attacker can determine a list of smart devices by querying an unprotected API using a valid username, indicating weak access control on user-oriented API ...

CVE-2025-31941

An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...

CVE-2025-31933

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-31933

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-31357

An unauthenticated attacker can obtain a user's plant list by knowing the username...

CVE-2025-31357

An unauthenticated attacker can obtain a user's plant list by knowing the username...

CVE-2025-30254

An unauthenticated attacker can obtain a serial number of a smart meters using its owner's username...

CVE-2025-27568

An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request...

CVE-2025-24487

An unauthenticated attacker can infer the existence of usernames in the system by querying an API...

CVE-2025-24487

CVE-2025-24487 concerns Growatt Cloud Applications (Cloud portal). Multiple connected sources indicate an unauthenticated attacker can infer the existence of usernames by querying an API, implying an exposed endpoint that reveals user existence without requiring authentication. Publicly cited ref...