CVE-2024-27631

CVE-2024-27631 취약점 세부 정보 개요 Savane v3.12 및 이전 버전에서는 관리 기능에 CSRF 보호가 없어 권한 상승 및/또는 계정 탈취가 가능합니다. 특히 /siteadmin/usergroup.php 엔드포인트는 다른 사용자의 비밀번호 및 관리자 플래그를 변경하는 기능을 포함하여, 공격자가 스스로 관리자가 될 수 있도록 합니다. CSRF에 취약한 다른 주요 엔드포인트는 다음과 같습니다: /support/admin/userperms.php - 게시판에 글을 작성할 수 있는 사용자의 권한을 변경합니다...

CVE-2025-40554

CVE-2025-40554 익스플로잇 스위트 SolarWinds Web Help Desk의 인증 우회 취약점CVE-2025-40554 / CVE-2025-40536을 탐지하고 익스플로잇하기 위한 종합적인 보안 테스트 도구입니다. ⚠️ 면책 조항 교육 및 공인된 보안 테스트 목적으로만 사용 이 도구는 사용자가 소유하거나 명시적인 서면 허가를 받은 시스템에 대한 보안 연구, 침투 테스트, 취약점 평가를 위해 제공됩니다. 컴퓨터 시스템에 대한 무단 접근은 불법입니다. 작성자는 이 도구의 오용이나 이로 인한 손해에 대해 책임을 지지...

CVE-2026-10243-AUTH

Smart Parking System 1.0 - 未授权访问关键管理员功能 漏洞信息 字段| 详情 ---|--- 产品| Smart Parking System 厂商| code-projects.org 版本| 1.0 漏洞类别| 关键功能缺少身份验证（CWE-306） CVE ID| 待定 CVSS 评分| 9.8 严重（AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H） 所需身份验证| 无 受影响文件| attendant.php、edit.php、basictable.php、basictable2.php、adminrequest.php 描述...

PT-2026-82780

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...

CVE-2026-27604 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/ endpoints. Because system resolves to the cron admin identity,...

CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...

CVE-2026-42286

The CVE-2026-42286 entry concerns Emlog, an open source website building system. Affected versions prior to 2.6.11 lack CSRF protection in critical admin functions, enabling an attacker to coerce authenticated admins into actions such as system registration, plugin management, and configuration c...

CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...

CVE-2026-42286 Emlog: Cross-Site Request Forgery in Admin Functions

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This...

DEBIAN-CVE-2026-41176

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and pri...

CVE-2026-40041

CVE-2026-40041 affects Pachno 1.0.6 and describes a cross-site request forgery (CSRF) vulnerability arising from missing CSRF protections on state-changing endpoints. Attackers can craft requests that execute actions in an authenticated user context via attacker-controlled sites, targeting login,...

CVE-2026-40041

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

EUVD-2026-12643

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...

CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...

CVE-2026-1364

CVE-2026-1364 affects IAQS and I6 developed by JNC, with a Missing Authentication vulnerability that allows unauthenticated remote attackers to directly operate system administrative functionalities. The issue is labeled as CRITICAL (CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/V C:H/I:H/A:H; base score 9...

PT-2026-4343

Name of the Vulnerable Software and Affected Versions IAQS and I6 affected versions not specified Description A missing authentication issue exists in IAQS and I6 developed by JNC. This allows unauthenticated remote attackers to directly operate system administrative functionalities...

CVE-2024-34240

QDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting XSS resulting in arbitrary code execution in admin functions related to adding or updating records...

CVE-2025-13990

CVE-2025-13990 concerns the Mamurjor Employee Info WordPress plugin. The vulnerability is a Cross-Site Forgery (CSRF) in all versions up to 1.0.0, caused by missing nonce validation on multiple admin actions. This allows unauthenticated attackers to forge requests that create, update, or delete e...

WordPress plugin Mamurjor Employee Info 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blogging sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site reque...

CVE-2025-52692

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials...