WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

sam-the-admin

Explotando CVE-2021-42278 y CVE-2021-42287 para suplantar a DA desde un usuario de dominio estándar Problemas conocidos no funcionará fuera de Kali, lo actualizaré más tarde : Echa un vistazo a Armamento de CVE-2021-42287/CVE-2021-42278 sAMAccountName spoofing...

ProxyLogon

ProxyLogon ProxyLogon es el nombre genérico formal para CVE-2021-26855, una vulnerabilidad en Microsoft Exchange Server que permite a un atacante eludir la autenticación y hacerse pasar por el administrador. También hemos encadenado este error con otra vulnerabilidad posterior a la autenticación ...

noPac

Acerca de Exploit de NoPac, que explota algunas vulnerabilidades antiguas CVE-2021-42278 y CVE-2021-42287 para suplantar a un administrador de dominio desde un usuario estándar. Se acabaron las dependencias molestas, solo un único binario, joder, amo Go, Python JAMÁS podría. El flag -shell...

moodle-login-csrf

Este repositorio contiene los archivos utilizados para encontrar y explotar dos fallos de Moodle, MSA-18-0020 CVE-2018-16854 y MSA-19-0004 CVE-2019-3847, que aprovechan la capacidad de los usuarios para añadir JavaScript a sus propios paneles. MSA-18-0020 se basa en CSRF en el formulario de inici...

Gogs_RCE

Reproducción de la vulnerabilidad GogsRCE 0x01 Registro de cuenta normal en el frontend 0x02 Compilar con go para falsificar la sesión de administrador go run main.go package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error fo...

CVE-2026-8181-Lab

CVE-2026-8181 — Laboratorio de omisión de autenticación de Burst Statistics Laboratorio Docker únicamente local para CVE-2026-8181 , una omisión de autenticación en el plugin de WordPress Burst Statistics – Privacy-Friendly WordPress Analytics. Este laboratorio compara una versión vulnerable del...

CVE-2021-34646

CVE-2021-34646 PoC detalle de esta vulnerabilidad por NVD Las versiones hasta la 5.4.3, inclusive, del plugin Booster for WooCommerce para WordPress son vulnerables a un bypass de autenticación a través de la función processemailverification debido a una debilidad en la generación de tokens...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

EUVD-2026-62678

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

CVE-2026-19834

Technical details about CVE-2026-19834 are not publicly available in the provided documents. Based on the supplied sources, only high-level description is given; no verified affected versions, vulnerable components, exploit specifics, or remediation steps are included. Monitor for updates.

PT-2026-72034

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description An authorization bypass exists in the Admin Customer Impersonation Feature within the file /admin/customers/login-as-customer/. A remote attacker can exploit this by manipulating the ID...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...

CVE-2026-15348

The CVE affects the WordPress plugin Premium Packages – Sell Digital Products Securely up to version 7.0.4 . The vulnerability arises in the download() function, which is hooked to the unauthenticated WordPress wp action and decodes the attacker-controlled wpdmppdl parameter with only base64_deco...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

PT-2026-60526

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret key used to sign session cookies, allowing unauthenticated attackers who know the public source value to...

GHSA-C2XG-QJQW-2V98 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerability ...

PT-2026-60356

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci check login function. Any user knowing any valid cookie string can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerabili...

CVE-2026-56451

A vulnerability has been identified in Opcenter X All versions V2604. Affected applications do not properly validate the algorithm specified in the JSON Web Token JWT header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersona...