90 matches found
CVE-2026-111633
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
CVE-2026-111633 ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
CVE-2026-111633 ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
CVE-2026-111633
The ZKEACMS content management system, versions through 4.4 , is vulnerable to an authentication bypass due to a hard-coded HMAC-SHA256 signing key located in JwtBearerDefaults.cs. Unauthenticated attackers can forge REST API JWT bearer tokens by setting the Name claim to 'admin'. This allows una...
EUVD-2026-103055
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
CVE-2026-111633: Use of Hard-coded Cryptographic Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
PT-2026-116032
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...
EUVD-2020-13455
Malware in sbrugna...
CVE-2025-11272
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
EUVD-2025-32435
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
CVE-2025-11272
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
CVE-2025-11272 SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
CVE-2025-11272
CVE-2025-11272 affects SeriaWei ZKEACMS up to version 4.3. The issue resides in the Delete function of src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs (POST Request Handler) and results in improper authorization with remote exploitation possible. Public exploit details have been d...
CVE-2025-11272 SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
PT-2025-40780
Name of the Vulnerable Software and Affected Versions SeriaWei ZKEACMS versions up to 4.3 Description A flaw exists in the Delete function within the src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs file of the POST Request Handler component. This issue results in improper...
CVE-2025-11272: Improper Authorization
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is...
ZKEACMS Authorization Issue Vulnerability
ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. An authorization issue vulnerability exists in ZKEACMS 4.3 and earlier versions, which stems from improper authorization of the Delete function in the file...
EUVD-2022-4123
Malicious code in bioql PyPI...