CVE-2026-20127

🛡️ CVE-2026-20127 — Omisión de Autenticación en Cisco Catalyst SD-WAN 📌 Resumen CVE-2026-20127 es una vulnerabilidad crítica de omisión de autenticación que afecta a los componentes de Cisco Catalyst SD-WAN, incluidos los controladores y sistemas de gestión. Un atacante remoto no autenticado puede...

CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: Inyección de Comandos del SO en Router TP-Link Para más información, ver https://vulners.com/cve/CVE-2026-3227 Una vulnerabilidad persistente y autenticada de Inyección de Comandos del SO en el firmware de routers TP-Link que puede causar el brick del dispositivo o una posible toma...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

Horde Groupware Unauthenticated Admin Access

Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. id: CVE-2005-3344 info: name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical description: Horde Groupware contains an administrative account wi...

CData Connect < 23.4.8846 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31849 info: name: CData Connect 23.4.8846...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Autorización faltante para configuración de API no autenticada/Actualización arbitraria de opciones/Creación de usuario administrativo...

CVE-2023-49982

CVE-2023-49982 School Fees Management System v1.0 - Control de acceso incorrecto - Escalada de privilegios Descripción : El control de acceso incorrecto en School Fees Management System v1.0 permite a los atacantes escalar privilegios y realizar acciones administrativas, incluyendo agregar y...

CVE-2026-16188

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16188 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16188

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a log injection flaw that allows a remote, unauthenticated attacker to forge entries in the server's administrative log . The CVELIST record specifies that versions prior to 9.0.5.29 and prior to 8.5.5.31 are affected, implying those ...

EUVD-2026-77800

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16189

IBM WebSphere Application Server 9.0 and 8.5 (prior to versions 9.0.5.29 and 8.5.5.31 respectively) allow a remote attacker to inject forged log entries into the server's administrative log. The vulnerability requires no prior authentication but has a high attack complexity, resulting in a CVSS 3...

CVE-2022-40684

CVE-2022-40684 Utilidades para explotar la vulnerabilidad CVE-2022-40684 FortiOS / FortiProxy / FortiSwitchManager - Bypass de autenticación en la interfaz administrativa...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 es una vulnerabilidad crítica en WSO2 Identity Server, una plataforma de gestión de identidad y acceso de código abierto. La vulnerabilidad permite a atacantes remotos cargar archivos JSP maliciosos que pueden ejecutar comandos arbitrarios en el sistema objetivo con...

CVE-2021-40859

CVE-2021-40859 Exploit de puertas traseras de Auerswald COMpact 8.0B Acerca de Se descubrieron puertas traseras en dispositivos Auerswald COMpact 5500R 7.8A y 8.0B, que permiten a atacantes con acceso a la aplicación web de gestión obtener acceso administrativo completo al dispositivo. Detalles d...