3285 matches found
All Thrive Themes and Plugins - Unauthenticated Option Update
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...
Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...
AnythingLLM - Information Disclosure
AnythingLLM suffers from an information disclosure vulnerability through the /api/setup-complete API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM...
Burp_Collector
Burp Collector Burp Collector is a multi-processing tool that is specifically designed to aid Pentesters and Bug Hunters in Web/Mobile Application testing. With its powerful capabilities, it streamlines the process of collecting and extracting information from Burp Suite files, empowering you to...
CVE-2023-27163
PoC of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and sensitive...
CVE-2026-125744
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout...
CVE-2022-1388_PoC
F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ ...
CVE-2026-63288
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer...
EUVD-2026-120775
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer...
CVE-2026-63288
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint, effectively bypassing the intended authentication layer . This vulnerability is associated with CWE-306 (Missing Authentication for Critical Functionality). While the technical impact is hig...
CVE-2026-63288
A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer...
zenml-CVE-2024-2083-POC
CVE-2024-2083 – ZenML Arbitrary File Read PoC This repository demonstrates how to reproduce CVE-2024-2083 , an Arbitrary File Read vulnerability in ZenML. The issue allows an attacker to read files from the server filesystem by abusing the logs.uri field in the /api/v1/steps API request. By...
PT-2026-141610
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout...
CVE-2026-125744: pretix: Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout...
CVE-2026-111453
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dagid query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...
EUVD-2026-119887
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dagid query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...
CVE-2026-111453
Apache Airflow's API endpoint for deleting an asset's queued events is vulnerable to an incomplete fix (CVE-2026-75157) in versions >=2.9.1,
PT-2026-140278
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dag id query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...
CVE-2026-111453: Apache Software Foundation Apache Airflow: Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id`…
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dagid query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...
Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass
Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint. id: CVE-2026-76460 info: name: Cisco Identity...