5923 matches found
CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72535
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
EUVD-2026-56005
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72535
CVE-2026-72535 affects Chaskiq. A missing authentication flaw (through commit 46dfdd1) allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication/authorization checks before c...
CVE-2026-72535
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
PT-2026-70202
Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...
PT-2026-70111
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...
CVE-2026-72535: Missing Authentication for Critical Function
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
PT-2026-70110
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...
CVE-2026-72784: Server-Side Request Forgery (SSRF)
Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT...
PT-2026-76027
The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from...
GraphQL Subscription / Alias Abuse
Probes GraphQL endpoints for subscription type introspection and alias amplification multi-typename batching signals. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL subscription introspection and alias amplification abuse. Complements auxiliary/scanner/http/graphqlabuse.py. """ from future...
Payload CMS API Enumeration
Probes Payload CMS REST endpoints /api/users, /api/posts and GraphQL for unauthenticated user and collection access. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Payload CMS users, collections, and GraphQL.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
Strapi GraphQL Abuse
Probes Strapi GraphQL endpoints for open introspection and unauthenticated usersPermissionsUsers / users queries exposing emails. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi GraphQL introspection and user enumeration.""" from kittysploit import from lib.protocols.http.httpclient import...
OpenCTI Auth Bypass (CVE-2026-27960)
CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The compile-time admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f authenticates as admin on every deployment. !/usr/bin/env python3 -- coding:...
OpenCTI CVE-2026-27960 Auth Bypass Detect
Detects CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f is identical across deployments and authenticates as admin when sent as a bearer...
opencti v7.260807.0
Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of th...