CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Omisión de autenticación de recursos entre organizaciones en Pangolin Prueba de concepto para CVE-2026-72001 , una falla de autorización a nivel de objeto roto en Pangolin 1.22.0 que permite al poseedor de un enlace para compartir de un recurso generar una sesión de recurso válid...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

socialhunter

socialhunter !IMPORTANT 此工具已无法正常工作，由于难以绕过社交媒体保护机制，我们无法修复它。 抓取指定URL，发现可被劫持的损坏社交媒体链接。损坏的社交链接可能允许攻击者进行钓鱼攻击，同时也会损害公司声誉。在漏洞赏金项目中，损坏社交媒体劫持问题通常会被接受。 目前，它支持Twitter、Facebook、Instagram和TikTok，无需任何API密钥。 安装 使用二进制文件 你可以从 releases 页面下载预构建的二进制文件并运行。例如： wget...

CVE-2025-15260

CVE-2025-15260: Autorización faltante / Control de acceso roto en el Plugin - MyRewards – Puntos de fidelidad y recompensas para WooCommerce Aviso: Este repositorio se crea solo con fines educativos y divulgación ética. La vulnerabilidad ha sido reportada de forma responsable al proveedor y ha si...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2025-24000-exploit

CVE-2025-24000 — Exploit de escalada de privilegios en Post SMTP Resumen Este script explota la CVE-2025-24000 , una vulnerabilidad de control de acceso roto de alta gravedad en el plugin Post SMTP para WordPress versiones ≤ 3.2.0. Permite que cualquier usuario autenticado con una cuenta de bajos...

vRealizeLogInsightRCE

VMSA-2023-0001 POC para VMSA-2023-0001 que afecta a VMware vRealize Log Insight e incluye los siguientes CVEs: Vulnerabilidad de Directory Traversal en VMware vRealize Log Insight CVE-2022-31706 Vulnerabilidad de control de acceso roto en VMware vRealize Log Insight CVE-2022-31704 VMware vRealize...

BrokenHill

!\ Logotipo de Broken Hill \https://assets.kitploit.com/production/public/readmes/44608/c14154675c6f33f5c3887887afcdb39351c82f269ee2772cf31847106a20a871.jpg Broken Hill Broken Hill es una herramienta de ataque automatizada, lista para usar y puesta en producción, que genera prompts solicitudes...

cve-2026-86060

CVE-2026-86060 — Escalada de privilegios preautenticación en SSH de MikroTik RouterOS hasta el control administrativo total Campo| Valor ---|--- CVE| CVE-2026-86060 Producto| MikroTik RouterOS servicio SSH Versiones afectadas| RouterOS 6.x y 7.0.0 – 7.23.3 inclusive Versiones corregidas| RouterOS...

CVE-2026-73318

CVE-2026-73318: Missing authorization on force-agreement actions XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController...

CVE-2022-42889-Text4Shell-POC

POC de Secuestro de Enlace Roto Por: Alfaz Descargar CVE-2022-42889-Text4Shell-POC Haz clic aquí...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

CVE-2026-97297

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

CVE-2026-97277

Subscriber Broken Access Control in Social Boost = 3.6.2 versions...

CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97258

Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...

CVE-2026-62073

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...