CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: autorizzazione mancante sugli endpoint dei plugin Docker → RCE sull'host Prova di concetto per CVE-2026-44848 , una vulnerabilità di autenticazione mancante CWE-862 in Portainer che consente a un utente non amministratore con accesso all'endpoint Docker di eseguire...

CVE-2025-5880

Whistle 2.9.98 enthält eine ungepatchte Path-Traversal-Schwachstelle, da der Endpunkt /cgi-bin/sessions/get-temp-file die Benutzereingaben im Parameter filename nicht ausreichend bereinigt. Durch die Angabe absoluter Pfade oder Traversal-Sequenzen wie /etc/passwd kann ein Angreifer die...

Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...

GHSA-79CW-HFCC-7MW9 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...

GHSA-H854-C3M3-MH5V Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim...

CVE-2026-71518

CVE-2026-71518 — Typemill: Umgehung der Autorisierung ohne Authentifizierung Pfadäquivalente URL-Varianten umgehen rollenbeschränkte Medien-Downloads Die Einschränkung basiert auf dem rohen Anfragepfad; die Datei wird über den vom Betriebssystem aufgelösten Pfad gelesen — die beiden weichen...

CVE-2026-65400

CVE-2026-65400 Spenden Unterstütze die Wartung dieses Projekts mit PayPal oder durch Scannen des QR-Codes unten. ⚡ Einfache Nutzung Verwende dieses Projekt nur in sicheren und autorisierten Umgebungen wie: Lokale virtuelle Maschinen Docker-Container Isolierte Laborumgebungen Autorisierte...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Correzione incompleta di CVE-2026-21724 consente al ruolo Editor di eliminare i contact point protetti Prodotto: Grafana Grafana Labs — fino alla 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Controllo degli accessi improprio CVSS 3.1:...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: il CheckToken JWT non rivalida mai lo stato dell'account Prodotto: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Scadenza della sessione insufficiente CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 Alto CNA: Turan Security · Scheda CVE Descrizione La...

CVE-2026-74251

Nicht authentifizierte SQL-Injection über den Attributfilter in Phoca Cart Phoca Cart ≤ 6.1.6 — Nicht authentifizierter Angreifer extrahiert die vollständige Datenbank durch zeitbasierte Blind-Injection ZUSAMMENFASSUNG Die GET-Array-Parameter a Attribut und s Spezifikation der öffentlichen...

ShuckNT

🔐 ShuckNT : Shuck den Hash, bevor du versuchst, ihn zu knacken | Das Skript von Shuck.sh ShuckNT ist das Skript des Online-Dienstes Shuck.sh für den Einsatz vor Ort jetzt online ausprobieren!. Es wurde entwickelt, um Authentifizierungstoken auf Basis des Data Encryption Standard DES herabzustufen...

VulnHub-DC1-Writeup

VulnHub-DC1-Writeup "Writeup di laboratorio di penetration testing che documentano catene di attacco complete — dalla ricognizione alla root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Difficoltà: Principiante–Intermedio Piattaforma: VulnHub Obiettivo: Catturare tutte e 4 le flag e ottenere la...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

GHSA-X5G3-W747-2H8Q plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

CVE-2026-41452-PoC

CVE-2026-41452 — Bypass de Autenticação no Instalador do Krayin CRM → Assunção de Conta de Admin CVSS 9.8 Crítico · CWE-287 / CWE-306 · Writeup da Jiva · VulnCheck Resumo O instalador do Krayin CRM expõe POST /install/api/admin-config-setup além de run-migration, run-seeder sem proteção CSRF grup...

CVE-2026-44402

CVE-2026-44402 Esecuzione Remota Completa di Comandi senza autenticazione in Voltronic Power SNMP Web Pro 1.1 Contenuto Vendor interessato: https://voltronicpower.com/ Prodotto interessato: SNMP Web pro 1.1 SNMP Web Pro 1.1 contiene una vulnerabilità di esecuzione remota di codice non autenticata...

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Summary 9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can...

GHSA-86M2-FCXQ-5Q7C 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Summary 9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can...

CVE-2026-55040

Bypass dell'autenticazione JWT di Microsoft SharePoint CVE-2026-55040 Panoramica CVE-2026-55040.py è uno script proof-of-concept per sfruttare la vulnerabilità di bypass dell'autenticazione di SharePoint, CVE-2026-55040. Per un'analisi tecnica completa, consulta la nostra Analisi Rapid7. Utilizzo...