CVE-2026-57850

Summary RustDesk sessions are authorized for a specific connection type — Remote full desktop control, FileTransfer, PortForward, ViewCamera, or Terminal. Before 1.4.9, the server's post-authorization message gate only checked one boolean, self.authorized, and never re-checked it against the...

CVE-2020-0728

CVE-2020-0728 Details Der TrustedInstaller.exe-Dienst läuft als NTAUTHORITY\SYSTEM und hostet den Sxs Store Class 3C6859CE-230B-48A4-BE6C-932C0C202048 COM-Dienst zusammen mit dem Interface ISxsStore. Die Zugriffsberechtigungen O:BAG:BAD:A;;CCDCLC;;;PSA;;CCDC;;;SYA;;CCDC;;;BAA;;CCDC;;;IUA;;CCDC;;;...

NextJS_CVE-2025-29927

Dimostrazione di Bypass dell'Autenticazione in Next.js Questa applicazione dimostra la vulnerabilità x-middleware-subrequest in Next.js 13.4.19, che consente di aggirare la protezione del middleware. Setup 1. Installare le dipendenze: root@kitploit: npm install 2. Avviare il server di sviluppo:...

CVE-2026-82475

iFlytek astron-agent through 1.1.1 is affected by an authorization bypass in the copyFlow endpoint , which fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers to overwrite other tenants' workflows or copy private workflows to read their definitions, re...

EUVD-2026-68131

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...

CVE-2026-82463

pac4j-core (a Java-based authentication and authorization library) versions prior to 6.5.6 are affected by an authentication bypass in CheckProfileTypeAuthorizer . The root cause is reversed profile type validation logic , which allows an attacker authenticated via a weaker client (e.g., generic ...

cve-2023-34034

cve-2023-34034 Dimostrazione del bypass dell'autorizzazione CVE-2023-34034 in Spring Security. Vedi CVE-2023-34034 Bypass dell'autorizzazione di Spring Security su Don't Panic!...

CVE-2022-22978

CVE 2022-22978: Autorisierungsumgehung in RegexRequestMatcher 🥶 Überblick Nach meinen Recherchen handelt es sich um eine Schwachstelle in der Klasse RegexRequestMatcher im Spring-Security-Framework. Konkret können Anwendungen, die RegexRequestMatcher verwenden, wenn der reguläre Ausdruck einen...

CVE-2025-3102

SureTriggers 🔥 Sviluppato da 0xgh057r3c0n 📌 Dettagli della Vulnerabilità Nome Plugin: SureTriggers Versioni Affette: --newmail --newuser --newpass...

CVE-2024-50395

CVE-2024-50395 Informazioni CVE È stata segnalata una vulnerabilità di bypass dell'autorizzazione tramite chiave controllata dall'utente che interessa il componente aggiuntivo Media Streaming. Se sfruttata, la vulnerabilità potrebbe consentire ad attaccanti della rete locale di ottenere privilegi...

CVE-2025-29927

CVE-2025-29927 Scanner di Bypass del Middleware Next.js CVE-2025-29927 CVE-2025-29927 è uno strumento di sicurezza specializzato per rilevare la vulnerabilità di bypass del middleware di Next.js CVE-2025-29927 che interessa le versioni di Next.js dalla 11.1.4 alla 15.2.2. Questa vulnerabilità...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Vulnerabilità di bypass del middleware in Next.js Questo repository dimostra la vulnerabilità CVE-2025-29927 in Next.js in cui l'header interno x-middleware-subrequest può essere utilizzato per bypassare i controlli del middleware come l'autenticazione. Versioni...

NextSecureScan

NextSecureScan - Next.js-CVE-2025-29927 Middleware-Schwachstellenscanner NextSecureScan ist ein umfassender Sicherheitsscanner, der speziell dafür entwickelt wurde, Middleware-bezogene Autorisierungsbypass-Schwachstellen CVE-2025-29927 in Next.js-Anwendungen zu identifizieren. Dieser Scanner nutz...

CVE-2025-29927

CVE-2025-29927 ★ CVE-2025-29927 PoC del bypass del middleware di Next.js ★ Descrizione CVE-2025-29927 : PoC del bypass del middleware di Next.js descrizione: Next.js è un framework React per la creazione di applicazioni web full-stack. Dalla versione 1.11.4 fino alle versioni precedenti a 12.3.5,...

next-CVE-2025-29927

CVE-2025-29927: Bypass dell'autorizzazione nel middleware di Next.js Una vulnerabilità critica in Next.js CVE-2025-29927 consente l'accesso non autorizzato a rotte protette bypassando la logica del middleware. Il problema riguarda le versioni di Next.js dalla 11.1.4 alla 13.5.6, e le versioni 14....

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admininit function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the...

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Lin CMS Spring Boot - Default JWT Token

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application. id: CVE-2022-32430 info: name: Lin CMS Spring Boot - Default JWT Token author: DhiyaneshDK severity: high description: | An access control issue in Lin CM...