EUVD-2026-80667

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92456 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2026-92456

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController , allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy stored in shared Redis keys. An attac...

EUVD-2026-80661

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2023-43148

CVE-2023-43148 Autor : Aitor Herrero Fuentes Proveedor: SPA-Cart Página del proveedor: https://spa-cart.com/ Enlace del software: https://demo.spa-cart.com/admin Versión: 1.9.0.3 Probado en: Windows 10 Pro CSRF ELIMINAR TODAS LAS CUENTAS La vulnerabilidad de Cross Site Request Forgery en la...

MSF-screenrecord-on-MacOS

MSF-screenrecord-on-MacOS !!! Esta vulnerabilidad ha sido descubierta o tomada simultáneamente por Sudhakar Muthumani de Primefort Private Limited, Khiem Tran y listada como CVE-2022-22600. Esto a pesar de que ya había enviado un correo a Apple sobre esto en 2021. Versiones afectadas Como...

CVE-2026-89948 batman-adv: bla: fix freeing of claims on meshif deletion

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix freeing of claims on meshif deletion When the mesh interface is getting deleted, then batadvbladelbackboneclaims via batadvblapurgebackbonegw could make sure that all claims gets removed. But this function is...

CVE-2026-79993

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

EUVD-2026-80332

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-79993

CVE-2026-79993 is an authorization bypass in Apache ZooKeeper (versions 3.9.0–3.9.5 and 3.8.0–3.8.6). The internal-only deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, completely skipping both the session check and the DELETE ACL check enforced by the...

CVE-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images para WordPress - Eliminación Arbitraria de Archivos 📋 Índice 1. Sobre la Vulnerabilidad 2. Requisitos Previos 3. Instalación 4. Métodos de Prueba Prueba Rápida Prueba Completa con Docker Prueba con Nuclei Prueba Manual 5. Interpretando Resultados 6. Limpieza 7...

CVE-2025-62950-PoC

Descripción Esta prueba de concepto PoC describe una vulnerabilidad de falsificación de solicitudes entre sitios Cross-Site Request Forgery, CSRF encontrada en el plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. El problema permite a un atacante engañar a un usuario...

CVE-2026-88910

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-85131

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts...

CVE-2026-76553

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

WordPress kboard plugin < 6.7 - Unauthenticated Board Media Deletion vulnerability

Unauthenticated Board Media Deletion vulnerability discovered by SeongJun Joo in WordPress Plugin kboard versions 6.7...

EUVD-2026-80213

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-88910

kboard , a WordPress plugin for forum/notice board functionality, is vulnerable in versions before 6.7 to an unauthenticated IDOR (Insecure Direct Object Reference) flaw in its board media deletion endpoint. The plugin fails to verify ownership or context before processing a media deletion reques...

CVE-2026-88910 KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...