CVE-2020-37160

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37160 SprintWork 2.3.1 - Local Privilege Escalation

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain...

CVE-2020-37106 Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2020-37106

The CVE-2020-37106 issue affects Business Live Chat Software 1.0 and is described as a cross-site request forgery (CSRF) vulnerability. A remote attacker can craft a malicious HTML form that sends a POST to the user creation endpoint with administrative access parameters to change user account ro...

CVE-2020-37106

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with...

CVE-2026-25544

creationtimestamp| type| source ---|---|--- 2026-02-06 22:16:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7wmw6fh723 2026-02-07 14:00:20+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mebldrpbyd24 2026-02-07 14:00:25+00:00| seen|...

CVE-2026-2067

creationtimestamp| type| source ---|---|--- 2026-02-06 21:18:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tdxkruj23 2026-02-06 21:18:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tezhskz23...

CVE-2026-25749

creationtimestamp| type| source ---|---|--- 2026-02-06 19:21:38+00:00| seen| https://gist.github.com/EbonJaeger/d35ee8e23d9e45964fc3a86bc738c87d 2026-03-18 05:03:24+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mhcpjgbgmce2 2026-03-19 00:00:00+00:00| seen|...

CVE-2026-23989

REVA (OpenCloud Reva component) contains a vulnerability in its GRPC authorization middleware that lets a malicious user bypass the public link scope verification via the archiver service, enabling creation of an archive (zip/tar) containing all resources within the link’s scope. Affected version...

CVE-2026-23989 REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to...

CVE-2026-23989 REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to...

GHSA-5QHX-GWFJ-6JQR Gogs user can update repository content with read-only permission

Vulnerability Description The endpoint PUT /repos/:owner/:repo/contents/ does not require write permissions and allows access with read permission only via repoAssignment. After passing the permission check, PutContents invokes UpdateRepoFile, which results in: Commit creation Execution of git pu...

GHSA-P6X6-9MX6-26WJ

creationtimestamp| type| source ---|---|--- 2026-02-06 18:10:05+00:00| seen| https://gist.github.com/alon710/4df0dc54735b275488bf3aa51c4b4e68...

Gogs user can update repository content with read-only permission

Vulnerability Description The endpoint PUT /repos/:owner/:repo/contents/ does not require write permissions and allows access with read permission only via repoAssignment. After passing the permission check, PutContents invokes UpdateRepoFile, which results in: Commit creation Execution of git pu...

CVE-2025-69619

creationtimestamp| type| source ---|---|--- 2026-02-06 16:20:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7cp4fpis25...

CVE-2026-2097

creationtimestamp| type| source ---|---|--- 2026-02-06 12:06:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html 2026-02-10 07:19:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meigebo2nw23...

CVE-2026-2095

creationtimestamp| type| source ---|---|--- 2026-02-06 12:06:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html 2026-02-10 07:21:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meighaymld2g 2026-02-10 09:00:35+00:00| seen|...

CVE-2026-21643

creationtimestamp| type| source ---|---|--- 2026-02-06 10:00:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me6nhfw7lq23 2026-02-06 15:33:53+00:00| seen| https://infosec.exchange/users/decio/statuses/116024412137620292 2026-02-09 09:16:18+00:00| seen|...

EUVD-2026-5691

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-15566

creationtimestamp| type| source ---|---|--- 2026-02-06 04:58:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me64lfqnlr2h 2026-02-06 13:56:03+00:00| seen| https://bsky.app/profile/kubernetes.dev/post/3me72n6p2qy2o 2026-02-06 14:08:57+00:00| seen|...