115679 matches found
GHSA-2JRP-QC93-H2J8 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole the core @apostrophecms/archive-page does, so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move operation in the...
CVE-2025-29927-PoC
CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This repository contains a Proof of Concept PoC exploit for CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass authorization checks by abusing a middleware-specific HTTP header. Overview CVE ID:...
CVE-2026-112861
The Participants Database plugin for WordPress (versions up to 2.7.8.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . This vulnerability is caused by an Authorization Bypass Through User-Controlled Key , where incorrectly configured access control security levels allow for unauth...
EUVD-2026-105222
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...
CVE-2026-112861 WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...
autogpt-CVE-2026-30950-poc
AutoGPT CVE-2026-30950 POC Proof-of-concept demonstration for CVE-2026-30950, an authenticated IDOR Missing Authorization in the AutoGPT Platform that lets any logged-in user reassign — and thus hijack — any other user's chat session via a single PATCH request, with no prior access to the session...
CVE-2026-113670
The ApostropheCMS Node.js content management system is vulnerable to an authorization bypass in its core page REST API prior to version 4.33.0 . The issue stems from the use of .permission(false) in the getOne and all=1 tree dump handlers within packages/apostrophe/modules/@apostrophecms/page/ind...
CVE-2025-29927
🕷️ Next.js CVE-2025-29927 🧑🏻💼 Legal Disclaimer This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware CVE-2025-29927. It is provided solely for lawful, educational, and research purposes. By accessing, using,...
CVE-2026-113665
The ApostropheCMS open-source Node.js content management system contains a missing authorization vulnerability in its notification module prior to version 4.33.0 . Specifically, the PATCH and DELETE REST endpoints perform operations directly on the underlying MongoDB collection without verifying ...
CVE-2026-28328
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...
CVE-2026-113648
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...
CVE-2026-6145
CVE-2026-6145 — User Registration & Membership for WordPress: Unauthenticated Admin Approval Bypass Proof-of-concept exploit for CVE-2026-6145 , a missing authorization vulnerability in the User Registration & Membership plugin for WordPress ≤ 5.1.5 that allows unauthenticated attackers to bypass...
CVE-2026-113660 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized...
CVE-2026-113660
Prior to version 4.33.0 , the ApostropheCMS open-source Node.js content management system is vulnerable to an authenticated object-level authorization bypass in its exist-in-locale API. This flaw allows an authenticated low-privilege user to verify the existence of restricted documents across var...
CVE-2024-52429
CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...
CVE-2026-20896
Proof of Concept Code CVE-2026-20896 This script automates the exploitation of the logic flaw in Gitea's API route validation, allowing to force the server to grant a valid administrative token through a Directory Traversal attack in the authorization header. !/usr/bin/env python3 PoC: Gitea...
EUVD-2026-105175
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...
CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...
CVE-2026-28328
SolarWinds Observability Self-Hosted is impacted by a broken authorization schema (CWE-863). This vulnerability allows low-privileged users to access and modify information that falls outside of their assigned permissions. The issue results in a HIGH base severity (CVSS 3.1 score of 8.8), with si...