48647 matches found
Vulnerability of the DOM component: The security features of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow attackers to circumvent existing security restrictions.
Vulnerability of the DOM component: The security of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relies on bypassing authentication using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
The vulnerability of the ngx_quic_module module in NGINX Plus and NGINX Open Source web servers allows a attacker to cause a service failure.
The vulnerability of the ngxquicmodule module in NGINX Plus and NGINX Open Source web servers relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability can allow a malicious actor to cause service failures...
The vulnerability of the N8n automation platform, related to bypassing authentication using a user-controlled key, allows attackers to disclose protected information.
The vulnerability of the N8n automation platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability allows an attacker, operating remotely, to disclose protected information by sending a specially crafted request with the projectId parameter...
PT-2026-41643
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Description Insufficient token rotation validation occurs during remote cluster invite confirmation. An authenticated attacker can bypass token rotation and...
š CPanel/WHM CRLF Injection / Authentication Bypass / Remote Code Execution
This Metasploit module exploits CVE-2026-41940, a CRLF injection in cPanel/WHMs cpsrvd daemon that allows unauthenticated remote code execution as root. The Basic-auth handler writes the password to the raw session file without stripping newlines. Omitting the ob-part of the session cookie bypass...
PT-2026-41692
Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.19.0 Description Arcane improperly exposes Git repository management endpoints to any authenticated user, allowing low-privileged accounts to modify repository configurations, exfiltrate stored Git credentials, acces...
The vulnerability of the Next.js web application development software platform, related to bypassing the authentication process by using an alternative path or channel, allows attackers to circumvent existing security mechanisms and gain unauthorized access to protected information.
The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication procedures by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized...
Vinyl/Varnish -- HTTP/2 parsing deficiency
Vinyl Development Team reports: A deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack request smuggling, which in turn can be used for cache poisoning, authentication bypass or possibly even information disclosure and manipulation...
Exploit for CVE-2026-8181
CVE-2026-8181 Burst Statistics | Authentication Bypass to Admi...
CVE-2018-25333
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloa...
CVE-2018-25333
CVE-2018-25333 concerns the Nordex N149/4.0-4.5 Wind Turbine Web Server. The vulnerability is an SQL injection in the login flow: attackers can craft POST requests to login.php (no authentication required) to execute arbitrary SQL and potentially bypass login, leaking data. Affected software is N...
CVE-2018-25333
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloa...
EUVD-2018-21857
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloa...
Exploit for CVE-2026-8181
CVE-2026-8181 ā Burst Statistics Authentication Bypass Lab Lo...
curl: CRLF Injection via Custom HTTP Headers
Summary: libcurl writes user-supplied custom headers directly into the HTTP request buffer without stripping \r\n characters. The raw input pointer origp in Curladdcustomheaders lib/http.c is serialized verbatim into the outgoing request using curlxdynaddfreq, "%s\r\n", origp instead of using the...
CVE-2026-8737
A weakness has been identified in Sanluan PublicCMS 5.202506.d. This issue affects the function execute of the file publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java of the component Trade Address Query Handler. Executing a manipulation of the argume...
CVE-2026-8737
Sanluan PublicCMS 5.202506.d contains a vulnerability in the Trade Address Query Handler component. The issue is in publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java, where manipulating the arguments userId/id can bypass authentication. The flaw allo...
PT-2026-41522
A weakness has been identified in Sanluan PublicCMS 5.202506.d. This issue affects the function execute of the file publiccms-trade/src/main/java/com/publiccms/views/directive/trade/TradeAddressListDirective.java of the component Trade Address Query Handler. Executing a manipulation of the argume...
CVE-2020-37228
iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks agains...
CVE-2021-47942 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
Home Assistant Community Store HACS prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh...