169091 matches found
CVE-2024-25832-PoC
CVE-2024-25830 and CVE-2024-25832 - DataCube3 Improper Access Control and Unrestricted File Upload. Overview This repository features a Proof of Concept PoC for a two-step exploit chain targeting DataCube3 devices. It combines CVE-2024-25830 Improper Access Control to extract root passwords and...
CVE-2023-34965
CVE-2023-34965 SSPanel UIM es un sistema de gestión de ventas de servicios de agencia multipropósito especialmente diseñado para los protocolos Shadowsocks / V2Ray / Trojan. La versión de SSPanel-Uim anterior a 2023.3 no restringe el acceso a la interfaz /link/, lo que puede provocar una filtraci...
CVE-2026-66916
Password-Protected Category Bypass via JSON Format in JoomGallery JoomGallery ≤ 4.3.0-stable — Unauthenticated Attacker Bypasses Password Gate to Download Protected Images SUMMARY An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is...
CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit
WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down...
CVE-2024-37742
CVE-2024-37742: Exploit de Portapapeles en SEB ≤ 3.5.0 Windows Este repositorio contiene una prueba de concepto PoC para explotar CVE-2024-37742, una vulnerabilidad en Safe Exam Browser SEB ≤ 3.5.0 en Windows. La vulnerabilidad permite a un atacante compartir datos del portapapeles entre el modo...
DEBIAN-CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
AZL-99977 CVE-2026-76560 affecting package 389-ds-base 3.1.1-12
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
CVE-2026-86451
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
CVE-2026-86418
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...
CVE-2026-76560 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
CVE-2026-76560
A flaw in 389 Directory Server (389-ds-base) where the SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value. This allows an unauthenticated client to satisfy access control checks intended to require a matching authent...
CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...
CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...
EUVD-2026-72362
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: organisation ID; UUID; name. Whe...
CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: - organisation ID; - UUID;...