105651 matches found
Tautulli <= 2.16.1 - Path Traversal
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...
OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation
OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...
Zarinpal Paid Download - Reflected XSS
Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...
Krayin CRM < 2.2.1 - Installer Authentication Bypass
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrati...
WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass
Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...
WP DeskLite - Reflected XSS
WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...
Vue Vben Admin - Default Credentials
Vue Vben Admin 2.10.1 contains a broken authentication caused by hardcoded credentials in the backend, letting attackers log in without proper authorization, exploit requires access to the login interface. id: CVE-2025-25570 info: name: Vue Vben Admin - Default Credentials author: 0xAkoko severit...
Dgraph <= 25.3.2 - Admin Token Disclosure
Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...
Oracle iPlanet Web Server 7.0.x - Image Injection
Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. id: CVE-2020-9314 info: name: Oracle iPlanet Web Server 7.0.x - Image Injection author:...
AffiliateImporterEb <= 1.0.6 - Reflected XSS
AffiliateImporterEb WordPress plugin through 1.0.6 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12732 info: name: AffiliateImporterEb =...
Payara Server - Cross-Site Scripting
Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...
CVE-2026-105179
The SourceCodester Drug Recommendation System 1.0 is affected by a vulnerability in the Password Handler component, specifically within the Admin/add_user.php file. A manipulation of the Password argument leads to the missing encryption of sensitive data . This vulnerability is exploitable via re...
CVE-2026-105179 SourceCodester Drug Recommendation System Password add_user.php missing encryption
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/adduser.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...
EUVD-2026-92179
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/adduser.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...
CVE-2026-105179 SourceCodester Drug Recommendation System Password add_user.php missing encryption
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/adduser.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...
CVE-2024-2961
Buddyforms 2.7.7 CNEXT RCE CVE-2024-2961 및 CVE-2023–26326을 악용하여 RCE 달성 사용법 git-clone https://github.com/suce0155/CVE-2024-2961buddyforms2.7.7 pip install -r requirements.txt python3 buddyforms2.7.7cnextexploit.py http://site/wp-admin/admin-ajax.php ip port 분석 및 기술 세부 사항 제 블로그 게시물을 확인하세요 POC...
CVE-2020-11444
CVE-2020-11444 Nexus 3 권한 우회 취약점 악용 스크립트 더 많은 스크립트 파일은 다음 참조: https://github.com/zhzyker/exphub Readme +-----------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-11444 Nexus 3 Unauthorized...
EUVD-2026-92163
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqlirealescapestring of the file /Admin/addsymptom.php of the component Symptom Creation. Performing a manipulation of the argument txtname results in sql injection. It is...