CVE-2020-9380

PoC IPTV Smarters Exploit Usage python gld.py -u http://www.pirate-ilegal-tv.com/ -i Vulnerability file includes/ajax-control.php: ?php / @ PHP 5.6 @ Decoder version : 1.0.0.1 @ Release on : 24.03.2018 @ Website : http://EasyToYou.eu / sessionstart; if fileexists"functions.php" includeonce...

CVE-2026-125747

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747 ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747

ZenTao PMS versions through 22.7 are vulnerable to a missing object-level authorization (IDOR) flaw in module/build/control.php. This vulnerability allows authenticated users with build privileges in any project to manipulate builds in projects they do not belong to by supplying sequential buildI...

EUVD-2026-121229

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747 ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125747: easysoft zentaopms: ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that…

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

PT-2026-141743

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-61719

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

EUVD-2026-113400

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61719

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in "saude/historicoprontuarios.php" arises because the "textoProntuario" field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61719: LabRedesCefetRJ WeGIA: WeGIA is a web manager for charitable institutions

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

PT-2026-132847

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$ REQUEST, including id, idatendido, idInterno, and...

CVE-2026-54671

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...

EUVD-2026-82574

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

CVE-2026-54670 WeGIA: Unauthenticated Auth Bypass + Local File Inclusion

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

PT-2026-95157

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description The contribution request dispatcher in the endpoint 'web/html/contribuicao/controller/control.php' accepts attacker-controlled nomeClasse and metodo values without a complete allowlist. This allows...

PT-2026-95158

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An authorization bypass exists where the software maps InternoControle to an empty resource array in the 'web/controle/control.php' endpoint. The verificarPermissao function in...

CVE-2026-54671: Authorization Bypass Through User-Controlled Key

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...