EUVD-2026-97833

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495

The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2022-1388

CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a...

CVE-2022-44877-CWP7

CVE-2022-44877-CWP7 Control Web Panel 7 CWP7 Remote Code Execution RCE CVE-2022-44877 Unauthenticated Repository will get updated with POC soon...

PoC_CVE-2019-0217

This repository contains a proof of concept exploit for CVE-2019-0217, along with a Dockerfile to set up a web server vulnerable to the CVE. CVE Description In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in modauthdigest when running in a threaded server could allow a user...

cve-2020-13933

cve-2020-13933 cve-2020-13933 Apache Shiro privilege bypass vulnerability This reproduction is very simple. First, set up the environment using IDEA + Shiro Reference: https://www.cnblogs.com/ph4nt0mer/p/13535999.html Then run, access, and capture packets...

nfc-ic-keys-dict

nfc-ic-keys-dict 2021-05-31 nfcPro.exe early version download http://www.nsccn.com/web/soft/win/20210531/nfcPro.exe keys for ic: 1D14130D1A0B/000000000000 How to detect the type of an iC card: Google Play Store = MIFARE Classic Tool = Tools = Show Tag Info UID: xxxxx 4 byte RF technology: ISO/IEC...

CVE-2026-108923

The 1024-lab smart-admin software (up to version 3.30.0 ) contains an improper access control vulnerability in the Support Config Query component. Specifically, a manipulation of the configKey argument within the /support/config/queryByKey file allows for unauthorized actions. This vulnerability ...

CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

MiniPlasma-Runner

MiniPlasma-Runner Modified version of Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adapted for C2 usage. Original PoC runs from disk only. This version runs entirely from memory via execute-assembly, with a split-binary approach to avoid detection. Disclaimer This tool is provided for authorized...

Malware in @coopeuch/common

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-49981

CVE-2023-49981 School Fees Management System v1.0 - Incorrect Access Control - Directory Listing Description : A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring...

Malware in @s4yhiitestpoc/r3-https

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-52199

CVE-2026-52199 : Unauthenticated Remote Code Execution in UZ801 4G Router Vulnerability Summary A critical Incorrect Access Control vulnerability exists in the Generic OEM UZ801v2.1 4G LTE Router Firmware V3.4.3. The device improperly exposes an unauthenticated Android Debug Bridge ADB daemon...

EUVD-2026-97774

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /path/list, POST /path, and POST /path/agentid' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let...

CVE-2018-20343

CVE-2018-20343 This is a PoC for CVE-2018-20343, a vulnerability in Ken Silverman's Build Engine. The generated .map file triggers a buffer overflow and overwrites the stack as shown below: Open Watcom under DosBox 0.74-2: the analyst controls the stack Under FreeDos 1.2: the analyst controls EIP...

EUVD-2026-97766

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

throttlestop-exploit-rw

Physical Memory Mapper Research tool demonstrating physical memory access through virtual-to-physical address translation combined with vulnerable driver exploitation. Overview This project explores low-level Windows memory management by combining the superfetch technique for address translation...