4328 matches found
service-now
service-now Service-Now Article Bruteforcer The idea here is that there is misconfiguration with articles and could expose sensitive information. Any Issues raise the it here - https://github.com/RandomRobbieBF/service-now/issues or submit a PR! How to Use python3 service-now.py -u...
CVE-2026-97160
CVE-2026-97160 — UP Plugin PHP Code Injection Joomla Python 3 PoC for CVE-2026-97160 — UP Universal Plugin for Joomla lomart.fr / up.lomart.fr. Description PoCbit / GitHub CVE-2026-97160 — UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 allow PHP code injection through up php=... shortcodes processed with...
CVE-2024-22939
target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc history.pushState'', '', '/' Success:...
CVE-2026-129143
The paicoding 1.0.3 software contains a missing authorization vulnerability in the ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to bypass access controls and read restricted content by enumerating article IDs via the GET /article/api/data/detail/{artic...
EUVD-2026-125617
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/articleId to retrieve full content of paid,...
CVE-2026-129144
The paicoding 1.0.3 software contains a payment bypass vulnerability in the /article/api/pay/callback endpoint. Authenticated attackers can unlock paid articles by exploiting weak payment confirmation codes. The root cause is a small space of random values (CWE-334) in IdUtil.genPayCode , allowin...
CVE-2026-126318
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the versionliveversion permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via...
EUVD-2026-125202
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the versionliveversion permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via...
CVE-2026-126318
REDAXO versions before 5.21.6 are susceptible to an authorization bypass vulnerability where editors lacking the version[live_version] permission can modify live article versions. The root cause is a failure in working version enforcement , allowing authenticated editors to bypass approval workfl...
CVE-2026-126318 REDAXO before 5.21.6 Authorization Bypass of Live Version Permission
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the versionliveversion permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via...
CVE-2026-24416
CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...
CVE-2021-38602
CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...
CVE-2024-37791
CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...
EUVD-2026-120539
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...
CVE-2026-125376
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...
CVE-2026-125376: Mereithhh vanblog: VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read…
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...
CVE-2026-125376 VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...
CVE-2026-125376
VanBlog versions through 0.54.0 are vulnerable to an information disclosure vulnerability. An unauthenticated attacker can read private and hidden articles by accessing the POST /api/public/article/:id endpoint. The root cause is that the getByIdWithPassword function fails to check the hidden fla...
CVE-2026-125376 VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...
CVE-2026-125376 VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...