CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103

A SQL Injection vulnerability exists in the Manacle Technologies ERP System due to insufficient validation and parameterization of user-supplied input in an API endpoint . An unauthenticated remote attacker can exploit this by providing specially crafted input to the vulnerable endpoint. Successf...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107102

The Manacle Technologies ERP System contains an account takeover vulnerability due to improper validation of payment callback parameters and inadequate authentication controls within an API endpoint. An unauthenticated remote attacker can manipulate specific parameters to force the application to...

GoFileX

GoFileX 비밀번호로 보호된 GoFile 공유를 대상으로 워드리스트를 순회하기 위한 90년대 후반풍 IRC 클라이언트 TUI. 문서화된 REST API하고만 통신하며, 속도 제한을 엄격한 규칙으로 취급한다: 순차 요청, 보수적인 기본 간격, 429 / error-rateLimit 발생 시 지수적 쿨다운, 그리고 반복적인 429 이후 자동 일시정지로 클라이언트가 IP 차단에 빠지지 않도록 한다. 작성자: @abraxasnull · github.com/abraxas · abraxaslabs.tech ·...

WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability

Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...

CVE-2015-3073

CVE-2015-3073 이 취약점은 원격 공격자가 취약한 Adobe Reader 설치 환경에서 API 제한을 우회할 수 있도록 합니다. 이 취약점을 악용하려면 사용자 상호작용이 필요하며, 대상자가 악성 페이지를 방문하거나 악성 파일을 열어야 합니다. 구체적인 결함은 AFParseDate에 존재합니다. 특정 JavaScript 명령어를 포함한 특수 제작된 PDF를 생성하면 JavaScript API 제한을 우회할 수 있습니다. 원격 공격자는 이 취약점을 악용하여 임의 코드를 실행할 수 있습니다. Windows 및 OS X에서...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-104049

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCE 익스플로잇 Gogs의 CVE-2025-8110 에 대한 자동화된 Python 익스플로잇입니다. 이 취약점은 PutContents API를 악용하여 원격 코드 실행RCE을 가능하게 하며, 해당 API는 파일 경로가 심볼릭 링크인지 검증하지 않습니다. 심볼릭 링크를 통해 내부 .git/config 파일을 덮어씀으로써 악의적인 sshCommand를 주입하여 리버스 셸을 트리거할 수 있습니다. 🛠️ 사전 요구 사항 Python 3 및 필요한 종속성이 설치되어 있는지 확인하세요. pip...

CVE-2023-27742

CVE-2023-27742 IDURAR ERP/CRM v1 обнаружил уязвимость SQL-инъекции через компонент /api/login. Описание IDURAR ERP/CRM v1 обнаружил уязвимость SQL-инъекции через компонент /api/login. Тип уязвимости SQL-инъекция Производитель продукта IDURAR ERP/CRM v1 База кода затронутого продукта...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

EUVD-2026-94186

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-86816

The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

EUVD-2026-94176

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...