CVE-2023-23752

CVE-2023-23752 — Joomla! ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table of Contents Overview Vulnerability Details How It Work...

CVE-2023-23752-poc

Affected versions: 4.0.0 = 4.2.8 Joomla 3 and below are not affected by this vulnerability. http://127.0.0.1/Joomla/api/index.php/v1/config/application?public=true This API is used to obtain the most important configuration information of the website, including the database username and password...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2026-84731: Missing Authentication for Critical Function

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

PT-2026-115071

Name of the Vulnerable Software and Affected Versions Nutanix Prism Element versions prior to 7.6.0.8 Nutanix Prism Element versions prior to 7.5.2 Nutanix Prism Element versions prior to 7.3.1.18 Nutanix Prism Central versions prior to 7.6.0.8 Nutanix Prism Central versions prior to 7.5.2 Nutani...

CVE-2026-68964

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2024-34320: Improper Access Control

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2024-34320

The ProPhoenix Law RMS software, specifically version v2022.2403.3.101 , is affected by an incorrect access control issue. This vulnerability exists within sensitive API endpoints , potentially allowing unauthorized access to restricted data or functions. The CVSS 3.1 score for this vulnerability...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2026-108730

A flaw was found in Raven. Legacy application programming interface API endpoints fail to verify workspace membership when retrieving messages and shared files. An authenticated remote attacker who is not a member of a workspace can exploit this flaw using predictable channel identifiers, resulti...

py3webfuzz

Py3webFuzz ';-- Python Biblioteca de módulo de fuzzing web Python3 Module Compatible Autor Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contribuyentes Nathan Hamiel @nathanhamiel DESCRIPCIÓN Basado en pywebfuzz, Py3webfuzz es un módulo de Python3 que ayuda a identifica...

cve-2022-36804

CVE-2022-36804: RCE pre-autenticazione in Atlassian Bitbucket Server Una vulnerabilità critica di command injection è stata trovata in molteplici endpoint API di Atlassian Bit bucket Server e Data center. Questa vulnerabilità riguarda tutte le versioni di Bitbucket Server e Data Center rilasciate...

CVE-2026-108585: Improper Limitation of a Pathname to a Restricted Directory

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

Vulnerabilities in Cisco License On-Prem

Cisco has identified several vulnerabilities in Cisco License On-Prem. These vulnerabilities reside in the web-based management interface and API endpoints of Cisco License On-Prem. Unauthorized attackers can reset passwords, write files, or create DoS conditions. Authorized attackers with...

CVE-2026-76265 Improper Access Control through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-62253

The Homer telecom observability software is vulnerable to a complete authentication bypass in versions prior to 11.0.283 . The root cause is that both JWTMiddleware and JWTMiddlewareV4 functions (located in coordinator/handlers/auth.go and coordinator/handlers/auth_v4_helpers.go) are designed to ...

Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service DoS condition, o...