Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch

Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin...

CVE-2026-54998-exp

DISCLAIMER This repository is for educational and research purposes only. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this material. Use at your own risk. Respect applicable laws and ethical guidelines. Overview CVE-2026-54998 is an Incorrect...

CVE-2022-0482_exploit

CVE-2022-0482 Vulnerability Exploitation Introduction This document outlines the detailed analysis of CVE-2022-0482, a critical security vulnerability identified in the Easy!Appointments scheduling software. This flaw, related to Incorrect Authorization under CWE-863, allows unauthorized access t...

gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth A Gitea OAuth2 access token scoped to only read:user can perform full write actions when it is sent as Authorization: Basic base64:x-oauth-basic instead of as a Bearer token. The scope check is skipped for any token presented over Basi...

superset-g3-v0-import-sql-plant

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · superset-g3-v0-import-sql-plant superset-g3-v0-import-sql-plant A coworker with a normal dashboard-editor account can hide their own database query inside a chart other people already trust. The next time anyone opens...

nextcloud-ldap-put-isadmin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin Write-up: https://abraxaslabs.tech/research/nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin...

vsftpd-cmds-denied-alias

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-cmds-denied-alias Write-up: https://abraxaslabs.tech/research/vsftpd-cmds-denied-alias vsftpd-cmds-denied-alias Class: Privilege leftover Reach: Remote vsftpd 3.0.5 - Chris Evans I pinned the official tarball,...

hyperswitch-unsigned-webhook

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · hyperswitch-unsigned-webhook Write-up: https://abraxaslabs.tech/research/hyperswitch-unsigned-webhook hyperswitch-unsigned-webhook Hyperswitch 2026.09.21.0 - Juspay Worldpayxml::verifywebhooksource returns Oktrue with...

gitea-public-only-pat-org

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-public-only-pat-org Write-up: https://abraxaslabs.tech/research/gitea-public-only-pat-org gitea-public-only-pat-org Gitea 1.27.3 - Gitea public-only on a PAT is supposed to be the promise that the token cannot...

proftpd-sftp-copy-file-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · proftpd-sftp-copy-file-write Write-up: https://abraxaslabs.tech/research/proftpd-sftp-copy-file-write proftpd-sftp-copy-file-write Class: Privilege leftover / File write Reach: Remote ProFTPD 1.3.9d f59f248 -...

sqlite-xfer-auth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-xfer-auth Write-up: https://abraxaslabs.tech/research/sqlite-xfer-auth sqlite-xfer-auth Class: Privilege leftover Reach: Local SQLite 3.53.4 b09c88c, SOURCEID 2026-07-24 19:02:57...

bitwarden-cipher-create-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · bitwarden-cipher-create-acl Write-up: https://abraxaslabs.tech/research/bitwarden-cipher-create-acl bitwarden-cipher-create-acl Bitwarden Server v2026.9.2 - Bitwarden Org cipher create on the Entity Framework path...

Adobe Commerce/Magento - Customer Session Identity Switch

Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...

phpmyadmin-issuperuser

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-issuperuser Write-up: https://abraxaslabs.tech/research/phpmyadmin-issuperuser phpmyadmin-issuperuser Class: Privilege leftover Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin...

joomla-media-override

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · joomla-media-override Write-up: https://abraxaslabs.tech/research/joomla-media-override joomla-media-override Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters CVE-2026-48947 taugh...

vsftpd-deny-file-brace-child

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-deny-file-brace-child Write-up: https://abraxaslabs.tech/research/vsftpd-deny-file-brace-child vsftpd-deny-file-brace-child Class: Privilege leftover Reach: Remote vsftpd 3.0.5 - Chris Evans The man page...

opencart-reward-free-checkout

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opencart-reward-free-checkout Write-up: https://abraxaslabs.tech/research/opencart-reward-free-checkout opencart-reward-free-checkout OpenCart 4.1.0.4 - OpenCart Ltd CVE-2025-15116 was a coupon race through 4.1.0.3. O...

CVE-2026-96512

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-96512 Write-up: https://abraxaslabs.tech/research/CVE-2026-96512 CVE-2026-96512 sudo 1.9.13p3 Debian bookworm - Sudo Project I am @abraxasnull. Local lab, not HTTP. The client is CVE-2026-96512-Abraxas-Labs.p...

EUVD-2026-112924

Incorrect Authorization CWE-863 in Elastic Cloud Enterprise ECE can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read-only access to the platform can change an installation-wide accoun...