ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

CVE-2024-48955_Overview

CVE-2024-48955Обзор Описание: Netadmin 4 IAM с ошибками контроля доступа. Затронутая версия: V4.030319 Система NetAdmin возвращает данные с функциями в конечной точке, которая "собирает" меню функций, ответ этого вызова не зашифрован и поскольку система не проверяет авторизацию сессии,...

CVE-2024-50967

CVE-2024-50967 DATAGERRY Нарушение контроля доступа Эта уязвимость затрагивает платформу DATAGERRY во всех версиях до 2.2.0 включительно ≤2.2.0...

CVE-2023-22515-Scan

CVE-2023-22515-Scan 개요 이것은 CVE-2023-22515에 대한 간단한 스캐너입니다. CVE-2023-22515는 Atlassian Confluence Data Center 및 Server의 치명적인 취약점으로, 현재 위협 행위자들이 활발히 악용하여 "승인되지 않은 Confluence 관리자 계정을 생성하고 Confluence 인스턴스에 접근"하고 있습니다. 이 취약점은 처음에 "권한 상승" 문제로 설명되었지만, Atlassian은 나중에 보안 권고에서 분류를 "손상된 접근 제어"로 변경했습니다...

golang-webmin-CVE-2022-0824-revshell

golang-webmin-CVE-2022-0824-revshell Webmin ターゲット URL c - Webmin の認証情報 sl - ペイロードをホストするローカルサーバーの IP とポート s - コールバック IP p - コールバックポート 参照 https://www.webmin.com/security.html https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295/ https://nvd.nist.gov/vuln/detail/CVE-2022-0824...

CVE-2025-25616

CVE-2025-25616 Unifiedtransform v2.0는 부적절한 접근 제어Incorrect Access Control 취약점이 존재하여, 학생이 시험 규칙을 수정할 수 있습니다. 영향을 받는 엔드포인트는 /exams/edit-rule?examruleid=1입니다. 공급업체: Unifiedtransform PoC 1단계: 학생으로 애플리케이션에 로그인합니다. 2단계: 다음 엔드포인트로 이동합니다. /exams/edit-rule?examruleid=1 examruleid 매개변수를 수정하여 다른 시험 규칙을 대상으로...

CVE-2024-45058

CVE-2024-45058 CVE-2024-45058의 PoC입니다. 이 취약점은 Broken Access Control로, 사용자 구성 섹션에서 보기 권한이 있는 사용자가 자신의 사용자 유형을 변경하여 관리자가 될 수 있습니다. 원하는 nivelusuario ID를 가져와서 익스플로잇을 실행하세요. 사용법 root@kitploit: usage: CVE-2024-45058.py -h -t TARGET -u USERNAME -p PASSWORD -i ID CVE-2024-45058 exploit options: -h, --hel...

CVE-2019-13403

CVE-2019-13403 Отчёт: May 2019 Исправление: May 2019 Автор: B3Bo1d Описание Temenos CWX версии 8.9 имеет уязвимость нарушенного контроля доступа Broken Access Control в модуле /CWX/Employee/EmployeeEdit2.aspx, что позволяет просматривать информацию пользователя. PoC До После Ссылка...

SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515

EVENTID-197 field| Value ---|--- EventID| 197 Event Time| 2023년 11월 09일 오전 09:47 Rule| SOC235 - Atlassian Confluence 접근 제어 우회 0-Day CVE-2023-22515 Level| 보안 분석가 Hostname| Confluence Data Center Destination IP Address| 172.16.17.234 Source IP Address| 43.130.1.222 HTTP Request Method| GET Requeste...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 уязвим для некорректного контроля доступа, что позволяет учителям отмечать посещаемость других учителей через конечную точку /courses/teacher/index?teacherid=2&semesterid=1. Разработчик: Unifiedtransform PoC Шаг 1: Войдите в приложение как учитель. Шаг 2:...

EUVD-2026-76868

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...

EUVD-2026-76866

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly...

CVE-2026-90546

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the like.json.php endpoint. The application fails to validate video access permissions before processing like requests, allowing any logged-in user to submit likes on password-protected an...

EUVD-2026-76862

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting...

EUVD-2026-76851

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90533

Flowise before 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. Any authenticated organization member can query the endpoint with an arbitrary user ID to retrieve the organization owner's full user record, including the bcrypt password hash ...

CVE-2026-27344

Inseri Core WordPress 플러그인의 Broken Access Control 플러그인: Inseri Core 영향을 받는 구성 요소: /includes/restapi.php 취약점 유형: Broken Access Control Missing Authorization 상태: 2026년 8월에 보고됨 – 중복 으로 종료됨. 요약 이번 여름 테스트 중, Inseri Core WordPress 플러그인에서 Broken Access Control 취약점을 발견했습니다. 이 플러그인은 “Export” 버튼에서 사용되는 RES...

CVE-2024-48217

CVE-2024-48217 Sismart 脆弱性 CVE 割り当て: CVE-2024-48217 mitre.org nvd.nist.org tenable.com 日付: 2024年9月5日 著者: Ajriel Rizqy Maulana ソフトウェアリンク: SiSMART Aplikasi Pintar Penunjang Proses Pendidikan - 7.4.0 SiSMART Aplikasi Pintar Penunjang Proses Pendidikan API バージョン: 7.4.0 脆弱性: IDOR - セッションストレージ内部...

CVE-2024-3656

Keycloak 24.0.5 уязвим к нарушению контроля доступа Broken Access Control, где атакующий может использовать любого аутентифицированного пользователя для выполнения некоторых действий API, таких как: Тестирование LDAP-подключений через конечную точку testLDAPConnection. Получение неуправляемых...