1201 matches found
CVE-2026-103065 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1...
CVE-2022-33891
「💥」CVE-2022-33891 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...
CVE-2024-38473-Nuclei-Template
CVE-2024-38473 Nuclei Template Description Nuclei template designed to detect Apache servers vulnerable to CVE-2024-38473. It first identifies servers running Apache Running Nuclei this way may yield a higher detection rate. You can also include URLs in this format within the hosts file to run th...
CVE-2024-54679
CVE-2024-54679 CVE-2024-54679 - CyberPanel aka Cyber Panel Denial of Service Description A denial of service DoS vulnerability was discovered in Cyber Panel that allows any authenticated user to restart the database by sending requests to the /dataBases/restartMySQL endpoint. This vulnerability...
Apache HTTP Server - ACL Bypass
Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. id: CVE-2024-38473 info: name: Apache HTTP Server - ACL Bypass author: pdteam severity: high...
AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790974923)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790974923 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user wi...
CVE-2020-11890
Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...
EUVD-2026-91395
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...
CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...
CVE-2026-104472
YesWiki versions prior to 4.6.7 are affected by a missing authorization vulnerability in the attachment download handler . This flaw allows unauthenticated attackers to bypass page read Access Control Lists (ACLs). By requesting the download handler with a known page tag and file parameter , an a...
CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...
CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...
CVE-2026-80337
Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...
BypassFuzzer
Bypass Fuzzer The original 403fuzzer.py : ==Note: This has been deprecated for my new, shiny burp extension that is 1000000% better. Thank you for using my tools!== You can find the extension here: https://github.com/intrudir/BypassFuzzer-Burp Fuzz 401/403ing endpoints for bypasses Perform variou...
Joomla 4.0.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)
According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities. - Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Jooml...
Cisco-SNMP-Slap
VISIÓN GENERAL cisco-snmp-slap utiliza la suplantación de direcciones IP para evadir una ACL que protege un servicio SNMP en un dispositivo Cisco IOS. Normalmente, la suplantación de IP tiene un uso limitado en ataques reales, aparte de DoS. Ningún servicio TCP puede completar el handshake inicia...
CVE-2026-72815-poc
CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC Versión en inglés Resumen Este repositorio es una Prueba de Concepto PoC local de la vulnerabilidad de IP spoofing CVE-2026-72815 GHSA-3fxj-6jh8-hvhx que existe en middleware.RealIP de go-chi/chi. El middleware RealIP vulnerable confía...