CVE-2019-14537

YOURLS: CVE-2019-14537 PoC When you get a valid timestamp you will be able to make requests to the api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats&timestamp=VALIDTIMESTAMP Usage usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip CVE-2019-14537 PoC...

CVE-2022-24990

CVE-2022-24990 Description - POC for CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation. - create by antx at 2022-04-12. Detail - The vulnerability allows a remote attacker to execute arbitrary commands on the target system. - The vulnerability...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFDReflected File Download for MediaWiki A remote user can create a specially crafted URL for the target site that, when loaded by the target user, will cause the 'api.php' script to download a file containing shell commands CVE-2017-8809. The file will be served by the target sit...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

CVE-2026-126545

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545 WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

EUVD-2026-123070

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545 WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

CVE-2026-126545

The WWBN AVideo software (versions through 29.7.1 ) is susceptible to a missing authorization vulnerability in the API::get_api_tags() function within plugin/API/API.php. This flaw allows registered users to bypass restrictions by querying the tags API. By subscribing to a tag and querying APINam...

CVE-2026-126545: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php…

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::getapitags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored...

PT-2026-144924

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get api tags in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and store...

Semantic MediaWiki'a Missing Authorization In The Smwtask API Module Allows Unauthenticated Access To Admin-only Mainten

Summary The "api.php?action=smwtask" API module performs no authorization check. The equivalent maintenance interface in the web UI "Special:SMWAdmin" requires the "smw-admin" right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can...

CVE-2026-116890

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

EUVD-2026-110718

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116890

Semantic MediaWiki versions 3.0.0 through 7.2.x are affected by a missing authorization vulnerability within the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by utilizing a public anonymous CSRF token. Impacted actions include reading ...

PT-2026-126351

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...