LEAKEY

LEAKEY 🔑 LEAKEY is a tool is for validation of leaked API tokens/keys found during pentesting and Red Team Enegagments. The script is really useful for Bug Hunters inorder to validate and determine the impact of leaked credentials. LEAKEY uses a json based signature file located at...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token Full walkthrough https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a differe...

CVE-2023-48084

CVE-2023-48084 Fixes broken syntax in the POC, primarily incorrect import and incorrect referral to API functions. automates the APIToken retrieval, stores the token as a variable and pipes into the fixed POC. https://github.com/Hamibubu/CVE-2023-48084 If for some reason this does not work,...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access...

CVE-2026-88897

Flextype CMS versions up to 1.0.0-alpha.3 transmit API authentication credentials via URL query string parameters in REST API routes. Because query strings are commonly logged, an attacker with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API a...

CVE-2026-30824-Flowise-NVIDIA-NIM-Authentication

CVE-2026-30824 — Flowise NVIDIA NIM Authentication Bypass Checker and Exploit A proof-of-concept checker and exploit for CVE-2026-30824 , a critical authentication bypass vulnerability in Flowise that exposes NVIDIA NIM API endpoints without authentication. Vulnerability Overview CVE-2026-30824 i...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS Privilege Escalation via Insecure API Token Generation NVD • Advisory • CWE-639 Overview The POST /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user at minimum Editor role to generate API tokens for any other user , including...

CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , its REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser ...

CVE-2026-61614 SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-85174

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...