105878 matches found
CVE-2020-14882-WebLogic-Analysis
Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...
CVE-2021-21425-RCE
this is my version i found a lot in internet but those are too bad USAGE python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 wait.. for 60sec you will get shell at your listener...
proofpoint-CVE-2023-0089
About Security researcher: ly1g3, ly1g3attuta.io GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Overview: Remote Code Execution - Low level authenticated user to admin RCE CVE: CVE-2023-0089 Timeline: Discovered - ly1g3 Reported - ly1g3...
CVE-2026-5118
Divi Form Builder β οΈ WARNING: This tool is for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test. More Disclaimer You can see the disclaimer on the cover of...
CVE-2026-61628
abraxaslabs.tech Β· github.com/abraxas Β· @abraxasnull Β· [email protected] Β· CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 - lucasdillmann I am @abraxasnull. Loopback lab. The client is CVE-2026-61628-Abraxas-Labs.py. Onboarding is anonymous. First-boot POST /api/users/onboarding/finish...
CVE-2026-91097-CVE-2026-91106
π¬ ΠΡΠΈΡΠΎΠ΅Π΄ΠΈΠ½ΡΠΉΡΠ΅ΡΡ ΠΊ Telegram Π΄Π»Ρ ΠΏΠΎΡΠ»Π΅Π΄Π½ΠΈΡ ΠΈΡΡΠ»Π΅Π΄ΠΎΠ²Π°Π½ΠΈΠΉ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ ΠΈ ΡΠ΅Π»ΠΈΠ·ΠΎΠ² ΡΠΊΡΠΏΠ»ΠΎΠΉΡΠΎΠ² HPLIP Printer Application β ΠΠ΅Π°ΡΡΠ΅Π½ΡΠΈΡΠΈΡΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ Π·Π°Ρ Π²Π°Ρ Π°Π΄ΠΌΠΈΠ½ΠΈΡΡΡΠ°ΡΠΎΡΠ° ΠΠ½ΡΡΡΡΠΌΠ΅Π½Ρ ΠΌΠ°ΡΡΠΎΠ²ΠΎΠΉ ΡΠΊΡΠΏΠ»ΡΠ°ΡΠ°ΡΠΈΠΈ, Π½Π°ΡΠ΅Π»Π΅Π½Π½ΡΠΉ Π½Π° HPLIP Printer Application Π²Π΅Π±-ΠΈΠ½ΡΠ΅ΡΡΠ΅ΠΉΡ Π½Π° Π±Π°Π·Π΅ PAPPL Π²ΠΎ Π²ΡΠ΅Ρ Π²Π΅ΡΡΠΈΡΡ HPLIP Π΄ΠΎ 3.26.6...
CVE-2025-1242
CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman β Gr0m Published...
CVE-2026-26718
Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via ...
CVE-2026-54477
CVE-2026-54477: Admin Panel Missing Security Headers clickjacking / XSS Advisory Field| Value ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Medium Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...
Active-Directory-BadSuccessor
Active-Directory-BadSuccessor Overview In this room, we explore the BadSuccessor privilege escalation technique, a vulnerability that abuses delegated Managed Service Accounts dMSAs in Active Directory. The attack allows a user with sufficient control over a dMSA object to impersonate another...
CVE-2026-51119
CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...
CVE-2026-105305
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...
CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field
Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...
CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...
EUVD-2026-93019
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...
CVE-2026-105305
A flaw exists in the OIDC implementation of Keycloak , specifically within the Device Authorization Grant flow . The root cause is that the flow fails to validate the minimum authentication level defined in client configurations. Consequently, an attacker possessing a stolen user password can byp...
CVE-2026-105305
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...
CVE-2026-6741
CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint β Calendar Booking Plugin CVE-2026-6741 β LatePoint Privilege Escalation Scanner Plugin: LatePoint β Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...
CVE-2026-23550
ββββββββββ βββββββββββ βββββββ βββββββ βββββββ βββββββ βββββββ βββββββ ββββββββ ββββββββ βββββββ βββββββββββ βββββββββββ βββββββββββββββββββββββββββββββββ ββββββββββββββββββββββββ βββββββββββββββββ βββ βββ βββββββββ ββββββββββββββββ βββββββββββββββ βββββββ βββββββββββββββ βββββββββββββββββ βββ ββ...
CVE-2026-8181
CVE-2026-8181 This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account...