cloudpanel-2.4.2-CVE-2024-44765-recovery

CVE-2024-44765 is an Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel versions 2.0.0 to 2.4.2 1. Follow instructions in every folder this should be done locally 2. Reset Passwords and Access for root $ sudo passwd root while for users $ getent...

CVE-2023-49543

CVE-2023-49543 Book Store Management System v1.0 - Incorrect Access Control Description : Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating. Vulnerable Product Version : Book Store...

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. id: CVE-2019-2578 info: name: Oracle Fusion...

CVE-2024-50657

CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...

CVE-2020-14965

CVE-2020-14965 ██╗ ██╗████████╗███╗ ███╗██╗ ██╗███╗ ██╗ ██╗███████╗ ██████╗████████╗██╗ ██████╗ ███╗ ██╗ ██║ ██║╚══██╔══╝████╗ ████║██║ ██║████╗ ██║ ██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗ ██║ ███████║ ██║ ██╔████╔██║██║ ██║██╔██╗ ██║ ██║█████╗ ██║ ██║ ██║██║ ██║██╔██╗ ██║ ██╔══██║ ██║...

CVE-2023-27350-PoC

CVE-2023-27350 This PoC demonstrates how it’s possible to bypass authentication in PaperCut MF/NG versions starting from 8.0 up to, but not including, 20.1.7, 21.2.11, and 22.0.9. It allows interaction with the system without using valid login credentials. Shodan Prompts 1. http.html:"papercut" 2...

EUVD-2026-112503

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

EUVD-2026-112491

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2025-29306

CVE-2025-29306 FOXCMS Content Management System Service Parameter Injection Vulnerability 1. Vulnerability Overview FoxCMS is a free, commercially available and open-source website management system built on PHP+MySQL architecture. FOXCMS Content Management System has a service parameter injectio...

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Incorrect Access Control Description : Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators. Vulnerable Product Version : Customer Support...

CVE-2026-51902

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/projectid allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts ...

PT-2026-132301

Name of the Vulnerable Software and Affected Versions Bulk Share : Location Sender version 2.1.0 Description Insecure permissions allow unauthorized attackers to invoke an exported component, enabling arbitrary data access and control over the internal data flow of the application. Recommendation...

EUVD-2026-113170

Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application...

CVE-2026-51903

SuperAGI v0.0.14 is vulnerable to an improper access control vulnerability within the get_agent_by_latest_execution function located in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can exploit this by supplying a victim project_id to the /agentexe...

CVE-2026-79589

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw. The vulnerability stems from the exposure of a UART debugging interface that lacks authentication, authorization, and access control functionality. An attacker with physical access can solder to and ...

CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the get_agent_execution_configuration function located in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can access and read another organization's agent executi...

CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

EUVD-2026-113343

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

CVE-2026-115706: Elastic Elastic Cloud Enterprise: Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege…

Authorization Bypass Through User-Controlled Key CWE-639 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Privilege Abuse CAPEC-122. An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials ca...