CVE-2020-37106 Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2020-37106

The CVE-2020-37106 issue affects Business Live Chat Software 1.0 and is described as a cross-site request forgery (CSRF) vulnerability. A remote attacker can craft a malicious HTML form that sends a POST to the user creation endpoint with administrative access parameters to change user account ro...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25544

creationtimestamp| type| source ---|---|--- 2026-02-06 22:16:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7wmw6fh723 2026-02-07 14:00:20+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebldrpbyd24 2026-02-07 14:00:25+00:00| seen|...

CVE-2026-2067

creationtimestamp| type| source ---|---|--- 2026-02-06 21:18:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tdxkruj23 2026-02-06 21:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tezhskz23...

CVE-2026-25749

creationtimestamp| type| source ---|---|--- 2026-02-06 19:21:38+00:00| seen| https://gist.github.com/EbonJaeger/d35ee8e23d9e45964fc3a86bc738c87d 2026-03-18 05:03:24+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mhcpjgbgmce2 2026-03-19 00:00:00+00:00| seen|...

CVE-2026-23989

REVA (OpenCloud Reva component) contains a vulnerability in its GRPC authorization middleware that lets a malicious user bypass the public link scope verification via the archiver service, enabling creation of an archive (zip/tar) containing all resources within the link’s scope. Affected version...

CVE-2026-23989 REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to...

CVE-2026-23989 REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to...

GHSA-5QHX-GWFJ-6JQR Gogs user can update repository content with read-only permission

Vulnerability Description The endpoint PUT /repos/:owner/:repo/contents/ does not require write permissions and allows access with read permission only via repoAssignment. After passing the permission check, PutContents invokes UpdateRepoFile, which results in: Commit creation Execution of git pu...

GHSA-P6X6-9MX6-26WJ

creationtimestamp| type| source ---|---|--- 2026-02-06 18:10:05+00:00| seen| https://gist.github.com/alon710/4df0dc54735b275488bf3aa51c4b4e68...

Gogs user can update repository content with read-only permission

Vulnerability Description The endpoint PUT /repos/:owner/:repo/contents/ does not require write permissions and allows access with read permission only via repoAssignment. After passing the permission check, PutContents invokes UpdateRepoFile, which results in: Commit creation Execution of git pu...

CVE-2025-69619

creationtimestamp| type| source ---|---|--- 2026-02-06 16:20:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7cp4fpis25...

CVE-2026-2097

creationtimestamp| type| source ---|---|--- 2026-02-06 12:06:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html 2026-02-10 07:19:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meigebo2nw23...

CVE-2026-2095

creationtimestamp| type| source ---|---|--- 2026-02-06 12:06:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html 2026-02-10 07:21:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meighaymld2g 2026-02-10 09:00:35+00:00| seen|...

CVE-2026-21643

creationtimestamp| type| source ---|---|--- 2026-02-06 10:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me6nhfw7lq23 2026-02-06 15:33:53+00:00| seen| https://infosec.exchange/users/decio/statuses/116024412137620292 2026-02-09 09:16:18+00:00| seen|...

EUVD-2026-5691

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-15566

creationtimestamp| type| source ---|---|--- 2026-02-06 04:58:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me64lfqnlr2h 2026-02-06 13:56:03+00:00| seen| https://bsky.app/profile/kubernetes.dev/post/3me72n6p2qy2o 2026-02-06 14:08:57+00:00| seen|...

CVE-2025-70073

An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function...

CVE-2025-68722

Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery CSRF vulnerability in the WebAdmin interface through improper handling of the s breadcrumb parameter. The application accepts state-changing requests via the GET method and automatically processes...