WordPress Easy Student Results <=2.2.8 - Improper Authorization

WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as...

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifyi...

Site Offline WP Plugin < 1.5.3 - Authorization Bypass

The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature. id: CVE-2022-1580 info: name: Site Offline WP Plugin 1.5.3 - Authorization Bypass author: s4e-io...

Spring Cloud Netflix - Server-Side Request Forgery

Spring Cloud Netflix 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and older unsupported versions are susceptible to server-side request forgery. Applications can use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. An attacke...

Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

WordPress RSVP and Event Management plugin before 2.7.8 is susceptible to missing authorization. The plugin does not have any authorization checks when exporting its entries, and the export function is hooked to the init action. An attacker can potentially retrieve sensitive information such as...

Jira - Incorrect Authorization

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...

Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter

Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp...

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...

Yamcs <=5.8.6 - Cross-Site Scripting

Yamcs 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirecturi parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL. id: CVE-2026-55549 info: name: Yamcs =5.8.6 -...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — 프론트 OIDC 세션 하이재킹 Keycloak을 대상으로 OIDC authorization code 플로우를 실행하고 PoC의 sessionid 하이재킹 훅을 노출하는 정적 프론트입니다. 팀 사용을 위해 nginx로 5174 포트에서 제공됩니다. VPS에서 실행하기 cd vps/pocCVE0264 docker compose up -d --build http://maquina:5174에서 확인할 수 있습니다. 공급업체 방화벽에서 5174/TCP 를 열어두세요8443에서 했던 것과 동일하게...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - 인증되지 않은 권한 상승을 초래하는 인가 누락 🚀 PT Project Notebooks ≤ 1.1.3 — 인증되지 않은 권한 상승 CVE-2025-5304 PT Project Notebooks 버전 1.0.0–1.1.3 에 대한 PoC 및 익스플로잇 도우미: wpnbptonewusersadd 함수의 인가 누락으로 인해 인증되지 않은 공격자가 admin-ajax.php를 통해 선택한 사용자의 권한을 관리자 로 상승시킬 수 있습니다. 🧾 설...

Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Apache Pluto 3.0.0의 인증 로직 문제로, 공격자가 HTTP 메서드를 변조하여 악성 파일을 업로드할 수 있습니다. python3로 작성된 스크립트입니다. 사용법: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

CVE-2026-105096

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has be...

CVE-2026-105097 Omega Solution CoinEx Crypto Customer Information API customer-currency authorization

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-105097

A vulnerability exists in the Customer Information API of Omega Solution CoinEx Crypto 2025 . The issue resides in an unknown function within the /customer-currency/ file, where manipulating the ID argument results in an authorization bypass . Remote exploitation is possible, and a public exploit...

EUVD-2026-92063

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-105096 Omega Solution CoinEx Crypto Customer Profile API customer authorization

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has be...

EUVD-2026-92059

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has be...