CVE-2024-1071-Docker

Dockerを使ったCVE-2024-1071 🎯 WordPressの新しいCVEを練習したいですか？指示に従ってください。 ラボの構築 1. Dockerをインストール：https://docs.docker.com/get-docker/ 2. プロジェクトをクローン：git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git。 3. プロジェクトに移動：cd CVE-2024-1071-Docker 4. Docker Composeファイルを起動：docker compose up -d。 5...

PT-2026-78893

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...

CVE-2026-65709: Authorization Bypass Through User-Controlled Key

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

Substack Breach: 662,752 User Records Leaked on Cybercrime Forum

Substack confirms a breach after hacker accessed internal user records now circulating on crime forums, exposing emails, phone numbers, and account metadata...

keycloak: Account REST API can update user metadata attributes

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

Code injection

EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcpmember API call...

CVE-2016-0886

CVE-2016-0886 affects EMC Documentum xCP (versions 2.1 before patch 24 and 2.2 before patch 12). The vulnerability allows remote authenticated users to disclose sensitive user-account metadata via the members/xcp_member API. Root cause is an information-disclosure issue in that API endpoint. Impa...