CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Exploit de Prueba de Concepto para CVE-2023-43208 , una vulnerabilidad de Ejecución Remota de Código no autenticada en Mirth Connect versiones anteriores a 4.4.1. Descripción Mirth Connect es un motor de integración sanitaria de código abierto ampliamente...

CVE-2023-43208

CVE-2023-43208 Mirth Connect 远程代码执行概念验证 针对 Mirth Connect 中 CVE-2023-43208 的概念验证 Python 脚本。 免责声明 仅限在您拥有或明确授权测试的环境中使用。此仓库用于安全研究、验证和防御性测试。作者不对因使用此工具造成的任何误用或损害承担责任。 概述 exp.py 是 PoC 的一个最小依赖版本，它能够： 检测目标是否看起来是 Mirth Connect 实例 通过 /api/server/version 请求 Mirth Connect 版本 检查版本是否低于 4.4.1 如果目标看似存在漏洞，则向...

CVE-2026-13544

A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project wa...

CVE-2026-56115

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but...

CVE-2026-56115 Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but...

CVE-2026-33736

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user including ROLESTUDENT can enumerate all platform users and access personal information email, phone, roles via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3...

CVE-2026-33736

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user including ROLESTUDENT can enumerate all platform users and access personal information email, phone, roles via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect RCE !Pythonhttps://img.shie...

GHSA-CH3W-9456-38V3 Netmaker has Privilege Escalation from Admin to Super-Admin via User Update

The user update handler PUT /api/users/username lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208-EXPLOIT Mirth Connect Remote Code Execution...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect Pre-Auth RCE Pre-authenticated...

CVE-2024-26478

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint...

CVE-2024-26478

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint...

CVE-2025-65900

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...

EUVD-2017-16546

Malware in sbrugna...

EUVD-2023-42527

Malicious code in bioql PyPI...

EUVD-2023-42526

Malicious code in bioql PyPI...

PT-2025-13393 · Unknown · Hay-Kot Mealie

Name of the Vulnerable Software and Affected Versions: hay-kot mealie version 2.2.0 Description: A Broken Object Level Authorization vulnerability in the component "/api/users/user-id" of hay-kot mealie allows users to edit their own profile in order to give themselves more permissions or to chan...

CVE-2024-46624

An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users...

CVE-2024-46624

CVE-2024-46624 affects InfoDom Performa 365 v4.0.1. An authenticated attacker can elevate privileges to Administrator by sending a crafted payload to the endpoint /api/users . The available data confirm the vulnerability and impact (high, with access network, low complexity, low privileges requir...