CVE-2026-86812

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-86815

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and r...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

LogMeInPoCHandleDup

LogMeIn / GoTo LMIInfo.sys ハンドル複製 概要 LogMeIn / GoTo RMM が提供する LMIInfo.sys ドライバには、SYSTEM プロセスから任意のハンドルを複製できてしまう競合状態（race condition）が存在します。 根本的な問題は、デバイスオブジェクトに対する適切なアクセス制御の欠如と、SYSTEM プロセスからユーザー指定のハンドルを複製するという明らかに不適切な判断に起因します。 詳細 IOCTL: 0x9211001C 入力バッファ: root@kitploit: // LMI-Common.cpp typedef...

CVE-2020-25747

CVE-2020-25747 推奨説明 Rubetek RV-3406、RV-3409、RV-3411カメラ（ファームウェアバージョンv342、v339）のTelnetサービスにより、リモートの攻撃者が認証なしでRTSPおよびONFIVサービスへのアクセスを取得できる可能性があります。したがって、攻撃者はカメラのライブストリームを視聴したり、カメラを回転させたり、一部の設定（明るさ、鮮明度、時間）を変更したり、カメラを再起動したり、工場出荷時の設定にリセットしたりすることができます。 追加情報 脆弱性に関する通知がベンダーに送付されました。 脆弱性タイプ 不適切なアクセス制御 製品のベン...

CVE-2023-49981

CVE-2023-49981 School Fees Management System v1.0 - 不適切なアクセス制御 - ディレクトリリスティング 説明 : School Fees Management System v1.0 におけるディレクトリリスティングの脆弱性により、攻撃者は認証/認可を必要とせずにアプリケーション内のディレクトリや機密ファイルを一覧表示できます。 脆弱性のある製品バージョン : School Fees Management System v1.0 CVE 作成者 : Geraldo Alcântara 日付 : 28/11/2023 確認日 :...

WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Salúa Es-sair in WordPress Plugin Passster versions = 4.3.13...

EUVD-2026-75972

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

CVE-2026-86779

Visualizer is a WordPress plugin for creating interactive data visualizations. In versions before 4.0.6 , the deleteChart endpoint performs only a site-wide capability check without verifying per-object ownership. This allows any user with the Contributor role or higher to permanently delete any ...

CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

CVE-2026-14566 Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

BIT-TOMCAT-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0 through 9.0.120. Th...

BIT-TOMCAT-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1....

CVE-2026-24061

🔒 CVE-2026-24061 - 重大な認証フロー欠陥を悪用する 🚀 はじめに CVE-2026-24061 プロジェクトへようこそ。このアプリケーションは、重大なセキュリティ欠陥を実演します。攻撃者は、GNU inetutils-telnetd の認証をバイパスできます。この README では、ソフトウェアのダウンロードと実行方法を案内します。 Download Now 📥 ダウンロードとインストール 最初に、Releases ページにアクセスしてアプリケーションをダウンロードしてください。ページには利用可能な最新ファイルが一覧表示されます。 Releases...

CVEs

Rhino CVE 概念実証エクスプロイト Rhino Security Labs のチームによって書かれた、さまざまな CVE に対する概念実証エクスプロイトスクリプトのコレクションです。 CVE-2025-32815: Infoblox NetMRI のハードコードされた認証情報による認証バイパス CVE-2025-32814: skipjackUsername を介した Infoblox NetMRI の未認証 SQL インジェクション CVE-2025-32813: getsamlrequest における Infoblox NetMRI の未認証コマンドインジェクション...

UniFi Access - Broken Access Control

UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access. id: CVE-2025-52665 info: name:...

pyLoad Flask Config - Access Control

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. id: CVE-2024-21644 info: name: pyLoad Flask Config ...

Nginx UI - Broken Access Control

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...

Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local...