CVE-2026-103079

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103078

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103079

The Ahmad JS Help Desk (js-support-ticket) plugin for WordPress, versions n/a through 4.0.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is an Authorization Bypass Through User-Controlled Key , where incorrectly configured access control security levels allow una...

EUVD-2026-92325

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103079 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103078

The WordPress JS Help Desk plugin (specifically the js-support-ticket component) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, identified as CWE-639 . This vulnerability allows for an Authorization Bypass due to incorrectly configured access control security levels, enabling a...

CVE-2026-103078 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

EUVD-2026-92308

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

Important: Red Hat Security Advisory: sudo security update

An update for sudo is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

My-CVEs

私が発見した脆弱性のリスト。 一部の脆弱性には、詳細な技術的解説、エクスプロイト、さらにはファジングセッションのウォークスルーが含まれています。 一部の脆弱性にはCVEが割り当てられていません。メンテナから連絡が途絶えたため、またはメンテナがセキュリティバグと認めなかったためです。それらも公開することにしました。 CVE| 対象| 簡単な説明| 発見手法| 解説/レポート/その他 ---|---|---|---|--- CVE-2025-58364| CUPS - Linux印刷スタック| 偽プリンタ応答によるリモートDoS| IPPパケットデシリアライズのファジング|...

Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass

Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsControllerdisplaypost. The controller calls post.reverttoparams:version directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is...

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

Casdoor - Authorization Bypass

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...

CVE-2021-29441

CVE-2021-29441 运行: CVE-2021-29441.exe ip 阿里nacos 越权添加账户...

CVE-2025-29927

高级 CVE-2025-29927 漏洞扫描器 这是一款专业级扫描器，旨在检测 Next.js 应用程序中的 CVE-2025-29927 中间件绕过漏洞。 🧠 功能简介 使用真实的无头浏览器（Playwright）深度爬取目标网站（包括 JS 渲染的内容） 使用精心构造的 X-Middleware-Subrequest 请求头测试内部路径，以绕过 Next.js 中间件 通过比较 HTTP 状态码和响应长度来识别绕过 完全多线程，高性能 🚀 快速开始 本地安装bash pip install -r requirements.txt playwright install 运行扫描器bas...

monitorr-exploit-toolkit

Monitorr エクスプロイトツールキット RCE は 安全でないファイルアップロード によるもの（PHP リバースシェル、ウェブシェルなど） 管理者アカウント作成 は 認証バイパス によるもの 技術情報の漏えい : Monitorr バージョン、PHP バージョン、システムバージョンとカーネル、PHP 設定など エクスプロイト対象: CVE-2020-28872 および CVE-2020-28871。 PacketStorm 使い方 $ ruby exploit.rb -h Monitorr-Exploit Usage: exploit.rb upload --debug...

EUVD-2026-92147

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler...

CVE-2026-96451

CVE-2026-96451 WordPress Ultimate Member プラグイン Ultimate Member におけるユーザー制御キーによる認可バイパスの脆弱性は、Ultimate Member Ultimate Member ultimate-member で権限昇格を可能にします。この問題は Ultimate Member: n/a から 2.13.1 までに影響します。 フィールド| 値 ---|--- 🆔 CVE| CVE-2026-96451 🏷️ CWE| CWE-639 — ユーザー制御キーによる認可バイパス 📊 CVSS 3.1| 8.8 HIGH...

claude-create-CVE-2025-29927

Next.js 中间件漏洞测试工具 CVE-2025-29927 此应用程序演示了 Next.js 中间件授权绕过漏洞 CVE-2025-29927。 关于该漏洞 CVE-2025-29927 是 Next.js 中间件中的一个授权绕过漏洞。通过发送一个精心构造的 HTTP 头 x-middleware-subrequest，攻击者可以绕过在中间件中实现的授权检查，从而获得对受保护资源的访问。 设置说明 1. 安装依赖： cd /var/www/react-nextjs/test-middleware-skip npm install 2. 启动开发服务器： npm run dev 3...

CVE-2026-105171

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler...