CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung Account Access Script This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region. How to use this script: 1. Host a we...

CVE-2026-48611-phpBB

CVE-2026-48611-phpBB Bypass Authentication simple poc bypass auth if you want to access via browser don't forget to change USERAGENT variable in script according to what is displayed in your browser so it can work. use cookie editor to replace value sid and u Affected: phpBB 3.3.16 and below +...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Passwo...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Passwo...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Passwo...

Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten...

PT-2026-111840

Name of the Vulnerable Software and Affected Versions youlai-boot versions prior to 2.21.2 Description A missing authorization issue allows any authenticated user to enable or disable accounts. This occurs because the updateUserStatus handler lacks a @PreAuthorize check, which is a security...

CVE-2026-84313

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

CVE-2026-84313

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...

CVE-2026-109317

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...

EUVD-2026-97619

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...

CVE-2026-109082

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-109082

A flaw in the keycloak-services component of Keycloak affects the Client-Initiated Backchannel Authentication (CIBA) implementation. The root cause is a failure to verify that a client is authorized to use the CIBA flow, which allows public clients to bypass security requirements. An attacker cou...

CVE-2026-109082

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-109082 Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-109082: Improper Authentication

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify...

CVE-2026-84313: Improper Authentication

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otpenroll and POST /api/finishpasskeyregister are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a...