Lucene search
+L

718 matches found

Nuclei
Nuclei
added 2026/09/12 2:04 a.m.20 views

KevinLAB BEMS 1.0 - SQL Injection

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through inputid POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and...

9.8CVSS8.1AI score0.06535EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.55 views

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS7.4AI score0.01776EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.97 views

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

9.8CVSS7.5AI score0.03257EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.32 views

Company Visitor Management System 1.0 - SQL Injection

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id...

9.8CVSS7.4AI score0.02442EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/09 10:36 a.m.7 views

CVE-2024-27198-EXPLOIT

CVE-2024-27198 - JetBrains TeamCity Authentication Bypass JetBrains TeamCity before 2023.11.4 is affected by an authentication bypass vulnerability that allows unauthorized users to perform admin actions. Impact The vulnerability's exploitation is critical as it grants attackers admin-level acces...

9.8CVSS8.3AI score0.99938EPSS
SaveExploits25
Kitploit
Kitploit
added 2026/09/08 11:46 a.m.7 views

CVE-2021-29441

CVE-2021-29441 - Nacos Authentication Bypass CVE-2021-29441 is a critical authentication bypass vulnerability affecting Nacos versions prior to 1.4.1. Nacos is a popular platform for dynamic service discovery, configuration management, and service administration used within cloud-native...

9.8CVSS8.3AI score0.87747EPSS
SaveExploits2
EUVD
EUVD
added 2026/09/03 6:54 p.m.9 views

EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

7.1CVSS5.9AI score0.00269EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/03 6:54 p.m.33 views

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

7.1CVSS0.00269EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/28 4:18 p.m.39 views

CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

8.1CVSS0.00273EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/10 11:17 a.m.33 views

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/10 10:41 a.m.12 views

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS5.1AI score0.00182EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/10 10:41 a.m.12 views

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS5.1AI score0.00182EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/08/10 7:16 a.m.15 views

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

8.8CVSS0.00287EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/10 6:00 a.m.7 views

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

5.3AI score0.00287EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/10 12:00 a.m.13 views

PT-2026-69992

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. This flaw enables an attacker to perform administrative actions...

8.6CVSS5.3AI score0.00144EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/05 2:54 p.m.15 views

CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...

5.1CVSS5.3AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/05 10:57 a.m.12 views

CVE-2026-71252 toner-management - Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

8.2CVSS5.3AI score0.00284EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/05 10:57 a.m.50 views

CVE-2026-71252 toner-management - Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

8.2CVSS0.00284EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/05 8:16 a.m.12 views

CVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

9.6CVSS0.00169EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/08/05 6:58 a.m.14 views

EUVD-2026-53196

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

9.6CVSS5.4AI score0.00169EPSS
SaveExploits1References1
Rows per page
Query Builder