CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...

EUVD-2026-63832

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the call...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin (versions ≤ 4.8.6 ) contains a critical authentication bypass (CVSS 9.8). The handle_email_otp_return() function returns the secret magic login token directly in the HTTP response to a publ...

CVE-2026-16323 Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

EUVD-2026-63825

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

Lurkstrain

Lurkstrain Un crawler all-in-one per pannelli di amministrazione per pentester...

kong-pwn

kong-pwn Usa la KongAPI esposta per agire come un proxy e ottenere URL di metadata o URL interni. CVE-2020-11710 - Non è una vulnerabilità, è una errata configurazione. Come usarlo root@kitploit: usage: kong-pwn.py -h -u URL -s SSRF -p PROXY kong-pwn.py: error: the following arguments are require...

magnolia-rce

Exploit-Titel: Magnolia DX Core 6.3.8 - Befehlsinjektion Datum: 05/16/2025 Exploit-Autor: tmrswrr Version: 6.3.8 Hersteller-Homepage: https://docs.magnolia-cms.com/home/ Produkt: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. Als Administrator...

CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

cve-2024-0012-poc

cve-2024-0012-poc CVE-2024-0012 è una vulnerabilità di bypass dell'autenticazione nel software PAN-OS di Palo Alto Networks. Questa vulnerabilità consente a un attaccante non autenticato di accedere all'interfaccia web di amministrazione tramite la rete, ottenendo i privilegi di amministratore di...

sqlmate

sqlmate Ci sono alcune funzionalità che pensiamo SQLMap dovrebbe avere. Come trovare il pannello di amministrazione del target, un miglior cracking degli hash, ecc. Se la pensi allo stesso modo, SQLMate fa per te. Cosa fa? Fornisci un dork di SQL injection tramite l'opzione --dork e troverà siti...

gladius

Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

CVE-2026-76156

Datiphy Data Management Center v8.3.0 through v8.5.1 has an OS command injection flaw (CWE-78) in its API endpoint, allowing authenticated administrators to execute arbitrary OS commands as root. No patch version or workaround is mentioned in the provided documents. Exploitation details are not p...

EUVD-2026-63794

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

f609-brute

f609-brute f609-brute é uma ferramenta simples de força bruta para roteadores ZTE F609 da Telkom Indonesia. Como a Telkom Indonesia implementa TR-069 nos modems ZTE F609, eles atualizam rotineiramente a senha de administrador. f609-brute é executado no Python 2.7. Uso usage: python f609.py Exempl...

EUVD-2026-63759

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

EUVD-2025-210758

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-79398

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...