CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

CVE-2026-13719 Alert rules in restricted folders disclosed via the alert rules list API

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

CVE-2026-13719 Alert rules in restricted folders disclosed via the alert rules list API

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

CVE-2026-13719

In Grafana , an authenticated user can exploit a vulnerability in the alert rules API list endpoint to access alert rules in folders they are unauthorized to read. This occurs because folder restrictions are dropped when a user's permitted folder set is empty, potentially returning every alert ru...

EUVD-2026-89774

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

Linux Distros Unpatched Vulnerability : CVE-2026-13719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the...

PlEXcalaison

Escalación de Privilegios Local PlEXcalasion - CVE-2021-42835 Plex Media Server para Windows anterior a la versión 1.25.0.5282, vulnerable a Time Of Check Time Of Use TOCTOU que permite a usuarios con pocos privilegios obtener privilegios de SYSTEM. Descubierto por Tomer Peled, Netanel Cohen y Am...

CVE-2026-36130

PoC Add the folder to lock Before reboot, the Defender process is still running After reboot, the Defender process MsMpEng.exe is gone...

CVE-2026-31321

PoC Defender is running Method 1 - Hide Windows Defender related folder Before Reboot After reboot, defender is gone Method 2 - Lock Windows Defender related folder After reboot Method...

Sub-folderFetcher

Sub-folder Fetcher 🐣 Un script para descargar una carpeta específica del repositorio Vulhub kibana/CVE-2018-17246 desde GitHub. 🚀 Requisitos curl unzip 🛠️ Uso chmod +x subfetcher.sh ./subfetcher.sh...

CVE-2025-8088

POC for CVE 2025-8088 WinRAR -o...

CVE-2024-22752

EaseUS MobiMover 6.0.5 Build 21620 - Permisos inseguros de archivos y carpetas MobiMoverUILaunch.exe sufre de una vulnerabilidad de elevación de privilegios que puede ser aprovechada por un "Usuario autenticado" para modificar el archivo ejecutable del servicio con un binario de su elección dentr...

Reset-inetpub

Restablecer inetpub Este script restaura la carpeta %SYSTEMDRIVE%\inetpub y sus permisos de seguridad predeterminados, necesarios como mitigación para CVE-2025-21204 después de la actualización de Windows KB5055523. Está destinado a usuarios que hayan eliminado esta carpeta sin comprender su...

winrar_CVE-2023-38831_lazy_poc

winrarCVE-2023-38831lazypoc Forma perezosa de crear un archivo winrar para probar CVE-2023-38831 Artículo que mencionó esta vulnerabilidad y la muestra: https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ La versión de winrar que estaba usando es winrar 5.91.0 Tomé un archivo winrar...

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

SideCopy-Exploits-CVE-2023-38831

SideCopy explota CVE-2023-38831 CVE-2023-38831 es una vulnerabilidad de ejecución remota de código RCE en WinRAR que afecta a versiones anteriores a la 6.23. Así es como un atacante puede explotarla: el archivo malicioso contiene tanto un archivo benigno como una carpeta con el mismo nombre que e...

CVE-2024-29404_Razer

CVE-2024-29404 Razer Synapse 3 =Synapse Version 3.9.131.20813 App Version =20240213 Vulnerabilidad de Elevación de Privilegios en la funcionalidad "Chroma Effects" mediante la Eliminación Arbitraria de Archivos/Carpetas https://github.com/user-attachments/assets/6528f166-5514-4b10-b1a4-3644ec11e7...

cve-2018-11714_POC

cve-2018-11714POC Se descubrió un problema en TP-Link TL-WR840N. Este problema es causado por un manejo inadecuado de sesiones en la carpeta /cgi/ o en un archivo /cgi. Si un atacante envía un encabezado de "Referer: http://192.168.0.1/mainFrame.htm" no se requiere autenticación para ninguna...