cve-2023-42820

cve-2023-42820 JumpServer Affected Versions v2.24 - v3.6.4 Impact With knowledge of the email associated with the JumpServer admin user account default: admin/[email protected], it is possible to reset the admin password through this vulnerability, and by combining it with JumpServer's...

Glassfish-research

GlassFish Security Research Vulnerability research on the Eclipse GlassFish administration console. CVE| Issue| Severity| Status ---|---|---|--- CVE-2026-2586| EL injection → RCE| 9.1 Critical| Fixed in 8.0.2 —| —| —| Pending disclosure CVE-2026-2586 — EL Injection to RCE Affected: 8.0.2 · CWE-91...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2023-32315

CVE-2023-32315 Openfire's administrative console the Admin Console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environmentin an already configured Openfi...

CVE-2025-52357

CVE-2025-52357 : Security Advisory: XSS in FD602GW-DX-R410 Router Admin Console Proof of Concept and Security Advisory for Reflected XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console firmware V2.2.14. Includes details, impact, and mitigation guidance. Overview A Cross-Site...

ai-agent-gateway

@tuskira/gateway-web Admin console for the Tuskira AI Agent Gateway. React 19 + Vite + TypeScript strict + Tailwind CSS 4 + shadcn/ui. Develop Requires Node 26+ and npm 11+ no pnpm. npm install npm run dev The dev server proxies /api to http://localhost:8081 see vite.config.ts, so run the gateway...

CVE-2020-8816

CVE-2020-8816 A Python script to exploit CVE-2020-8816, a remote code execution vulnerability on the Pi-hole. This script uses the techniques found by François Renaud-Philippon to achieve remote code execution on a Pi-hole running a web interface version less than 4.3.3. The exploit requires the...

CVE-2023-32315

CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author phith0n and K3ysTr0K3R Description Openfire is an XMPP server licensed under the Open Source...

OpenFire_Decrypt

OpenFireDecrypt Decrypt the admin console account password of OpenFire install openfire https://hub.docker.com/r/sameersbn/openfire docker pull sameersbn/openfire:3.10.3-19 docker run --name openfire -d --restart=always \ --publish 9090:9090 --publish 5222:5222 --publish 7777:7777 \ --volume...

CVE-2026-115547

An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...

CVE-2026-115546

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

EUVD-2026-108569

An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...

CVE-2026-115547

The Okta Access Gateway (OAG) Admin Console is vulnerable to Command Execution due to an input validation issue that allows the processing of specially formatted configuration values. An authenticated administrator can exploit this vulnerability to execute arbitrary system commands within the con...

CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway

An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...

EUVD-2026-108568

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

CVE-2026-115546

The Okta Access Gateway (OAG) contains an authentication source verification issue. The system fails to validate the selected authentication source during sign-on, allowing an authenticated user with an active session to modify the authentication source parameter. This vulnerability may result in...

CVE-2026-115546 Authentication Source Verification Issue in Okta Access Gateway

Okta Access Gateway OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Oracle iPlanet Web Server 7.0.x - Image Injection

Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. id: CVE-2020-9314 info: name: Oracle iPlanet Web Server 7.0.x - Image Injection author:...