proofpoint-CVE-2023-0090

About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Unauthenticated RCE CVE: CVE-2023-0090 Timeline: Discovered - ly1g3 Reported - ly1g3 Fixed - Proofpoint...

CVE-2018-19276

CVE-2018-19276 OpenMRS Insecure Object Deserialization RCE From https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 Insecure object deserialization allows Arbitrary Code Execution without needing to log in. IP restrictions on Webservices module do not prevent thi...

Blackash-CVE-2025-61757

🚨 CVE-2025-61757 — Pre-Auth RCE Alert 🚨 🧩 Summary ID: CVE-2025-61757 Product: Oracle Identity Manager Oracle Fusion Middleware Component: REST WebServices Affected Versions: 12.2.1.4.0 & 14.1.2.1.0 Severity: 🔴 Critical — 9.8 CVSS 3.1 Published: Oct 21, 2025 Type: Missing Authentication for Critic...

CVE-2026-14466 Possible XSS in the SNS web administration panel

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-14466

Stormshield SNS is vulnerable to a stored XSS in its web administration panel. An SNS administrator with appropriate permissions can inject a malicious script into a group's comments within the webservices administration interface , leading to execution in the context of other users. The CVSS v3....

CVE-2026-14466 Possible XSS in the SNS web administration panel

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-14466: Improper Neutralization of Input During Web Page Generation

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

PT-2026-85534

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-72532

Joomla! Core (versions 4.0.0–5.4.7 and 6.0.0–6.1.2) contains an improper access control check in category webservice endpoints, allowing users with high privileges to create categories they should not be authorized to. CVSS 4.0 scores it MEDIUM (5.1) with network attack vector. The Joomla securit...

PT-2026-80763

Name of the Vulnerable Software and Affected Versions resdata versions prior to 6.2.9 Description The software fails to correctly validate input within GRDECL files. This issue is particularly critical when the tool is used to parse untrusted files in networking contexts, such as webservices...

CVE-2026-60560

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-62602

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the REST WebServices component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

CVE-2026-60560: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-36035

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...

CVE-2026-36035

The CAXPerts UniversalPlantViewer WebServices Server v2.7.6 is affected by an incorrect access control vulnerability in the /api/License/deactivateOffline endpoint. This flaw allows authenticated attackers with low-level privileges to perform a Denial of Service (DoS) attack by removing the licen...

CVE-2026-36035: Improper Access Control

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...

Exploit for Eval Injection in Proofpoint Enterprise_Protection

About Security researcher: ly1g3, ly1g3attuta.io GPG finge...

CVE-2026-48958: Improper Access Control

An improper access check allows unauthorized users to create custom fields via webservices endpoints...

Joomla 4.0.x < 5.4.7 / 6.0.x < 6.1.2 Joomla 6.1.2 & 5.4.7 Security & Bugfix Release (joomla-6-1-2-5-4-7-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 5.4.7 or 6.0.x prior to 6.1.2. It is, therefore, affected by a vulnerability. - An improper access check allows unauthorized users to create custom fields via webservices endpoints...