CVE-2026-40172: Improper Privilege Management

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/pk/ API allows a caller with changeuser on a target user to assign arbitrary groups through UserSerializer, including groups with issuperuser=True, without...

Pagetool 1.07 (news_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== Pagetool 1.07 newsid Remote SQL Injection Vulnerability ========================================================== pagetool-1.07 Remote SQL Injection...

CVE-2006-6177: Undefined Security Weakness

SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remote authenticated users to execute arbitrary SQL commands via a double-url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif"...