CVE-2026-92754 PatrowlManager through 1.8.4 Improper Access Control via users API

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

EUVD-2026-81026

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

CVE-2026-92754

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint , where the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumerate all users and their privilege flags, including superus...

CVE-2026-92754 PatrowlManager through 1.8.4 Improper Access Control via users API

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

CVE-2026-92752

CVE-2026-92752 affects metasfresh , an ERP/business-management platform. The DocumentAttachmentsRestController and CommentsRestController endpoints validate only that a caller is authenticated but fail to enforce record-level permissions , allowing any logged-in user to enumerate sequential docum...

CentOS-Control-Web-Panel-CVE

CentOS Control Web Panel versión 0.9.8.836 - 0.9.8.847 El 29 de junio de 2019, nuestro equipo comenzó a buscar vulnerabilidades en CentOS Control Web Panel CWP versión 0.9.8.836 y encontramos algunas vulnerabilidades críticas. Algunas de las vulnerabilidades que encontramos pueden encadenarse par...

CVE-2026-26012

CVE-2026-26012 - Proof of Concept Authentified Organization Collection Permissions Bypass & Cipher Enumeration Vaultwarden NVD Reference: CVE-2026-26012...

CVE-2026-92605 IRIS through 2.4.29 Unauthorized Comment Access via Object ID

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...

CVE-2026-92605 IRIS through 2.4.29 Unauthorized Comment Access via Object ID

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...

CVE-2026-92605

IRIS (iris-web) through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. An attacker with access to any single case can enumerate sequential object identifiers and read comment threads from cases they are not aut...

ResetSpy

ResetSpy Sondea el endpoint de restablecimiento de contraseña de autoservicio SSPR de Microsoft para enumerar los métodos de verificación registrados y señalar cualquiera que carezca de un segundo factor fuerte. Proporciona enumeración de usuarios y una aproximación de la postura de MFA en cuenta...

disclo

disclo 域名联系人查找工具。输入一个域名，就能通过12个被动来源并行获取与之关联的所有邮箱、用户名和线索。 root@kitploit: $ python disclo.py gitlab.com disclo - gitlab.com ---------------------------------------------------------------------- hackerone https://hackerone.com/gitlab url 示例： root@kitploit: python disclo.py example.com python...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - Divulgación de información de usuarios Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2026-53959 Descargo de responsabilidad Este proyecto se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. No lo...

CVE-2026-26744

CVE-2026-26744 Existe una vulnerabilidad de enumeración de usuarios en FormaLMS 4.1.18 y anteriores en la funcionalidad de recuperación de contraseña accesible a través del endpoint /lostpwd. La aplicación devuelve mensajes de error diferentes para nombres de usuario válidos e inválidos por...

CVE-2025-66698

CVE-2025-66698 Target Software: Veda Semantic Machines v5.4.8 likely all prior versions. Vulnerability Type: Authentication Bypass. CVE ID: CVE-2025-66698. Summary: System improperly validates the ticket parameter, treating an empty string as a valid session. Project Link: Veda Semantic Machines...

CVE-2026-89029

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

GitLab GraphQL API User Enumeration

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. id: CVE-2021-4191 info: name: GitLab GraphQL API User Enumeration author: zsusac severity: medium description: An unauthenticated remote attacker can leverage thi...

EUVD-2026-80769

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

CVE-2026-89029 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

CVE-2026-89029

Adenion Blog2Social is a WordPress plugin that, in versions before 9.1.0 , exposes a user enumeration flaw. The b2s_get_select_mandant_user AJAX handler (in includes/Ajax/Get.php) resolves arbitrary user IDs supplied via the owner parameter to display names without verifying the caller's authoriz...