Lucene search
+L

718 matches found

Nuclei
Nuclei
added 2026/09/12 2:04 a.m.20 views

KevinLAB BEMS 1.0 - SQL Injection

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through inputid POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and...

9.8CVSS8.1AI score0.06535EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.55 views

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS7.4AI score0.01776EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.97 views

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

9.8CVSS7.5AI score0.03257EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/12 2:04 a.m.32 views

Company Visitor Management System 1.0 - SQL Injection

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id...

9.8CVSS7.4AI score0.02442EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/09 10:36 a.m.7 views

CVE-2024-27198-EXPLOIT

CVE-2024-27198 - JetBrains TeamCity 身份验证绕过 JetBrains TeamCity 在 2023.11.4 之前的版本存在一个身份验证绕过漏洞,允许未经授权的用户执行管理员操作。 影响 该漏洞的利用非常关键,因为它授予攻击者管理员级别的访问权限。此访问权限使他们能够更改配置、管理用户账户、访问敏感数据以及干扰服务器运行,给组织带来严重风险。 免责声明 使用责任: 本概念验证(PoC)漏洞利用仅供教育和研究目的使用。任何滥用本漏洞利用的行为均不被认可,且由用户自行承担全部责任。使用本漏洞利用即表示您承认并接受此行为责任。...

9.8CVSS8.3AI score0.99938EPSS
SaveExploits25
Kitploit
Kitploit
added 2026/09/08 11:46 a.m.7 views

CVE-2021-29441

CVE-2021-29441 - Bypass de Autenticación en Nacos CVE-2021-29441 es una vulnerabilidad crítica de bypass de autenticación que afecta a Nacos versiones anteriores a la 1.4.1. Nacos es una plataforma popular para el descubrimiento dinámico de servicios, gestión de configuración y administración de...

9.8CVSS8.3AI score0.87747EPSS
SaveExploits2
EUVD
EUVD
added 2026/09/03 6:54 p.m.9 views

EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

7.1CVSS5.9AI score0.00269EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/03 6:54 p.m.33 views

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

7.1CVSS0.00269EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/28 4:18 p.m.39 views

CVE-2026-82279 HyperDX Team Management Operations Missing Role-Based Access Control

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

8.1CVSS0.00273EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/10 11:17 a.m.33 views

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/10 10:41 a.m.12 views

EUVD-2026-55228

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS5.1AI score0.00182EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/10 10:41 a.m.13 views

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

8.8CVSS5.1AI score0.00182EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/08/10 7:16 a.m.15 views

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

8.8CVSS0.00287EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/10 6:00 a.m.8 views

CVE-2026-18786

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

5.3AI score0.00287EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/10 12:00 a.m.13 views

PT-2026-69992

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. This flaw enables an attacker to perform administrative actions...

8.6CVSS5.3AI score0.00144EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/05 2:54 p.m.15 views

CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...

5.1CVSS5.3AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/05 10:57 a.m.12 views

CVE-2026-71252 toner-management - Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

8.2CVSS5.3AI score0.00284EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/05 10:57 a.m.50 views

CVE-2026-71252 toner-management - Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

8.2CVSS0.00284EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/05 8:16 a.m.12 views

CVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

9.6CVSS0.00169EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/08/05 6:58 a.m.14 views

EUVD-2026-53196

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

9.6CVSS5.4AI score0.00169EPSS
SaveExploits1References1
Rows per page
Query Builder