808 matches found
CVE-2024-11680
ProjectSend CVE-2024-11680 Exploit Dies ist ein Proof-of-Concept-Exploit für CVE-2024-11680, eine nicht authentifizierte Konfigurationsänderungs- und Web-Shell-Upload-Schwachstelle in ProjectSend. Beschreibung Der Exploit nutzt mehrere Schwachstellen in ProjectSend aus: CSRF-Token-Umgehung, die...
CVE-2021-40113
CVE-2021-40113 Mehrere Schwachstellen in der webbasierten Verwaltungsoberfläche der Cisco Catalyst Passive Optical Network PON Series Switches Optical Network Terminal ONT könnten einem nicht authentifizierten, entfernten Angreifer ermöglichen, die folgenden Aktionen durchzuführen: Einloggen mit...
CVE-2024-31964
CVE-2024-31964 CVE-2024-31964 PoC: Telefone SIP Mitel Série 6900w - Bypass Temporário de Autenticação Detalhes da Vulnerabilidade Resumo Consiste em uma vulnerabilidade de bypass temporário de autenticação no painel do site administrativo HTTP de vários produtos Mitel. Impacto Permite que um...
CVE-2021-42562
CVE-2021-42562: MITRE Caldera में अनुचित पहुंच नियंत्रण Caldera versions =2.8.1 उपयोगकर्ता विशेषाधिकारों को ठीक से अलग नहीं करता है, जिसके परिणामस्वरूप गैर-एडमिन उपयोगकर्ताओं के पास उन कॉन्फ़िगरेशन या अन्य घटकों को पढ़ने और संशोधित करने की पहुंच होती है जो केवल एडमिन उपयोगकर्ताओं के लिए सुलभ होने...
CVE-2020-11107
CVE-2020-11107 यह CVE-2020-11107 के लिए एक राइटअप है जो मुझे मिला। Windows पर XAMPP में 7.2.29, 7.3.x से पहले 7.3.16 , और 7.4.x से पहले 7.4.4 से पहले एक समस्या पाई गई। एक अनप्रिविलेज्ड उपयोगकर्ता सभी उपयोगकर्ताओं एडमिन सहित के लिए xampp-contol.ini में .exe कॉन्फ़िगरेशन बदल सकता है, जिससे मनमानी...
EUVD-2026-64992
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...
CVE-2026-71933
DrayTek VigorSwitch (multiple models) is affected by unauthorized operation vulnerabilities in its syslog functions , caused by missing authorization checks . A remote unauthenticated attacker can send crafted requests to modify configuration , restart services , save startup configuration , or c...
CVE-2026-78387
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...
CVE-2026-15345
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15345 ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15345
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization WordPress plugin is vulnerable to an authorization bypass in all versions up to and including 3.11.5. The flaw arises from improper verification of a user’s authorization, enabling authenticated attackers with subscriber-level a...
CVE-2026-19908 PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The...
EUVD-2026-58801
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The...
CVE-2026-19908
CVE-2026-19908 affects the PAX Technology Q80 XCB Daemon. The flaw arises from a lack of authentication before accessing daemon functionality, allowing network-adjacent attackers to disclose sensitive information and modify configurations. The description also notes potential to execute arbitrary...
EUVD-2025-210674
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
CVE-2025-30238
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...
CVE-2026-23537
A vulnerability has been identified in the Feast Feature Server’s /save-document endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling a...