EUVD-2026-65587

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...

CVE-2026-75496

Webkul QloApps contains an improper file upload validation flaw. The application fails to properly validate uploaded file extensions or MIME types before moving the file to a publicly accessible directory . A remote, authenticated attacker with administrative privileges can exploit this by upload...

CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227：TP-Link 路由器操作系统命令注入 更多信息请参阅 https://vulners.com/cve/CVE-2026-3227 TP-Link 路由器固件中存在一个持久化的、经过身份验证的 OS 命令注入漏洞，可导致设备变砖或潜在的局域网接管。 免责声明 ：本仓库包含针对已修补漏洞的概念验证（PoC）代码。其仅用于教育目的和安全研究人员参考。 执行摘要 多款 TP-Link 路由器（包括 TL-WR802N、TL-WR841N 和 TL-WR840N）的配置备份/恢复机制中存在命令注入漏洞。拥有管理权限的攻击者可以下载路由器配置、对其进行解密、将恶意 OS...

CVE-2024-4898-Poc

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – ワンクリックのWP Staging & Migration = 0.1.0.38 - 未認証のAPIセットアップ/任意オプションの更新/管理者ユーザーの作成に対する認可の欠如...

CVE-2023-49982

CVE-2023-49982 School Fees Management System v1.0 - 访问控制不当 - 权限提升 描述 ：School Fees Management System v1.0 中的访问控制失效允许攻击者提升权限并执行管理操作，包括添加和删除用户账户。 受影响产品版本 ：School Fees Management System v1.0 CVE 作者 ：Geraldo Alcântara 日期 ：29/11/2023 确认日期 ：15/12/2023 CVE ：CVE-2023-49982 测试平台 ：Windows 受影响的组件 ：...

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

Horde Groupware Unauthenticated Admin Access

Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. id: CVE-2005-3344 info: name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical description: Horde Groupware contains an administrative account wi...

Cacti 1.2.24 - SQL Injection

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CData Connect < 23.4.8846 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31849 info: name: CData Connect 23.4.8846...

Hardcoded Admin Credentials For Cisco Smart Licensing Utility API

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit...

Zyxel - Authentication Bypass

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

CVE-2025-8730

CVE-2025-8730 – Belkin F9K1009/F9K1010 における認証バイパス 著者: Byte Reaper 説明: このリポジトリには、Belkin F9K1009 および F9K1010 ルーターの Web インターフェースに影響を与える重大な認証バイパスの脆弱性である CVE‑2025‑8730 の エクスプロイトが含まれています。 この欠陥は /login.htm...

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE infrar3d による これは、オープンソースの顧客関係管理（CRM）システムである Krayin CRM v2.2.x 向けに設計された、リモートコード実行（RCE）の概念実証（PoC）です。このスクリプトは、CRMの管理インターフェースにおけるファイルアップロードの脆弱性の悪用を自動化し、対象サーバー上でリモートコマンドを実行できるようにします。 使用方法: root@kitploit: python3 CVE-2026-38526.py --help usage: CVE-2026-38526.py -h -rh...

CVE-2023-22515

Confluence の脆弱性 - CVE-2023-22515 📓 はじめに Atlassianは、管理者アクセスを通じて環境を危険にさらす可能性のある脆弱性について報告を受けました。2023年10月4日、AtlassianはCVE-2023-22515に関するセキュリティアドバイザリを公開しました。このCVEは10.0と評価されています。この脆弱性は、Confluence Server および Data Center エディション のバージョン8.0.0で導入され、 8.3.3、8.4.3、8.5.2 のバージョンに存在します。...