111 matches found
Vmware-ESXI
CVE-2024-37085 subida de shell sin autenticación hasta administrador completo en hipervisores ESXi unidos a un dominio. Descargar ESXIVORTEX Detalles: un bypass de autenticación que permite la subida de un shell en el contexto de vpxuser, otorgando permisos administrativos completos en hipervisor...
CVE-2026-67279
MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...
CVE-2020-24033
The latest version of fs.com S3900 24T4S 1.7.1 and all previous version, CSRF backstage admin The form does not have a authentication or token authentication mechanism, so there is a Cross-Site Request Forgery Add user account to add an user with full access. All form on the S3900 24T4S are subje...
CVE-2026-mikrotik-poc
MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...
Teldat-Router-CVE-2022-POC
Enrutador Teldat CVE-2022-39996 y CVE-2022-39997 POC Prueba de concepto para dos vulnerabilidades descubiertas en los enrutadores Teldat RS123 / RS123w. Resumen ID CVE| Tipo| CWE| CVSS| Gravedad ---|---|---|---|--- CVE-2022-39996| XSS Reflejado| CWE-79| 6.1| Media CVE-2022-39997| Contraseña Débil...
cve-2026-86060
CVE-2026-86060 — MikroTik RouterOS SSH Pre-Authentication Privilege Escalation to Full Administrative Control Field| Value ---|--- CVE| CVE-2026-86060 Product| MikroTik RouterOS SSH service Affected versions| RouterOS 6.x and 7.0.0 – 7.23.3 inclusive Fixed versions| RouterOS 7.23.4 and later...
CVE-2026-73453
CVE-2026-73453 is a critical (CVSS 3.1: 10.0) code injection vulnerability (CWE-94 ) in Arista EOS configured with the P4Runtime service. An unauthenticated attacker who can reach the P4Runtime gRPC endpoint (port 9559) can craft a malicious packet during session initiation to achieve arbitrary c...
Exploit for CVE-2026-86060
CVE-2026-86060 — MikroTik RouterOS SSH Pre-Authentication Priv...
CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...
Exploit for CVE-2026-72898
🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...
CVE-2026-1728
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...
EUVD-2026-53821
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...
CVE-2026-1728
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...
CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...
CVE-2026-41452 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...
CVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security polici...
CVE-2026-61425
Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...
EUVD-2026-46068
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...
CVE-2026-61425
Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...
