322 matches found
CVE-2023-23752
CVE-2023-23752 Joomla未授权访问漏洞 fofa: product="Joomla" Usage root@kitploit: usage: CVE-2023-23752.py -h -u URL -f FILE -t THREAD -T TIMEOUT -o OUTPUT optional arguments: -h, --help show this help message and exit -u URL, --url URL Target urle.g. url.txt -f FILE, --file FILE Target filee.g. url.txt -...
Glances - Information Disclosure
Glances 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access. id: CVE-2026-30928 info: name: Glances - Information...
YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting
The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'queryString' parameter in the REST API endpoint /ywcas/v1/register in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. id: CVE-2024-4455 info...
CVE-2025-9074-Poc
Docker API 未授权远程代码执行 CVE-2025-9074 Docker Desktop 中的一个严重 CVE-2025-9074 漏洞，使得本地运行的 Linux 容器能够通过默认子网 192.168.65.7:2375 连接 Docker Engine API。无论是否启用增强容器隔离 ECI 或 TCP 暴露设置，该问题都会持续存在。CVE-2025-9074 的概念验证利用代码已公开。该漏洞可能允许未经授权访问主机系统上的用户文件。因此，风险等级被评定为高风险。 一个独立的 Bash 脚本，用于利用暴露的 Docker API（通常为 2375...
CVE-2025-9074
CVE-2025-9074 – Docker Desktop Windows 容器→主机写入（通过暴露的引擎 API） 作者： w01f 状态： 概念验证（仅用于教育/授权测试） 概述 本项目演示了 CVE-2025-9074 的概念验证，该漏洞涉及 Docker Desktop for Windows 某些版本中的配置错误/暴露问题——Docker 引擎 HTTP API （位于 http://192.168.65.7:2375）可从容器内访问（有时也可通过 SSRF 访问），使攻击者能够创建一个带有 bind mount 的容器，挂载到 Windows 主机驱动器，并向主机写入文件。...
CVE-2026-82453
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...
PT-2026-78817
Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description An unauthenticated user can access the add-on OpenAPI specification via Splunk Web static file paths. This exposure occurs because the generated OpenAPI...
CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...
MINI-7RJ6-XW76-Q2FJ
Bulletin has no description...
PT-2026-71887
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...
CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...
CVE-2026-73406
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...
EUVD-2026-57398
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...
PT-2026-69953
Name of the Vulnerable Software and Affected Versions TrustyAI Service affected versions not specified Description A flaw in the TrustyAI Service TAS deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. This could enable an attacker to...
CVE-2026-69127
Kirby (open-source CMS) has a REST API flaw where, prior to 4.9.5 and from 5.0.0 through 5.5.1, the API error handler can return unsanitized PHP error messages that reveal the full filesystem path of the Kirby installation to unauthenticated API users. The issue affects all sites that have not di...
CVE-2026-14943
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...
CVE-2026-12000 Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...
CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...
CVE-2026-67528 OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/customoptions/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visiblecurrentuser, so authenticated non-admin users could...