2885527 matches found
Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564
CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...
hackEmbedded
hackebds πδΈζ readme Overview hackebds is a toolkit for embedded-device payload generation, encrypted shell workflows, SOCKS5 proxy tunneling, and device information lookup. The current branch uses a pure ELF workflow for encrypted shell and proxy features: reverseshellfile + encryptedshellserver ...
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119627
The Gitea web profile and RSS/Atom feed routes are vulnerable to information disclosure due to insufficient access control. The application fails to validate the public-only restriction of a personal access token during authentication. Consequently, a user with a public-only token can use HTTP Ba...
EUVD-2026-114808
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119625 Gitea user and organization feed token scope bypass
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
CVE-2026-119625
The Gitea /{username} web route was vulnerable to an incorrect authorization issue (CWE-863) because it accepted personal access tokens via HTTP Basic authentication without verifying their scope. An attacker using a token with an unrelated scope (e.g., read:issue) could access a user's private a...
EUVD-2026-114807
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
CVE-2026-119533
Gitea repository and organization project boards were vulnerable to a missing authorization flaw (CWE-862) where they displayed pull requests referencing issues without verifying the viewer's permissions. If a public board contained an issue linked to a private pull request , anonymous visitors c...
CVE-2026-119533 Gitea private pull request disclosure on project boards
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull...
EUVD-2026-114806
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull...
CVE-2026-118504 Gitea issue changes on archived repositories through the API
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels a...
CVE-2026-118504
The Gitea platform contains a vulnerability where several REST API issue routes fail to verify if a repository is archived. While the web interface correctly blocks modifications to archived repositories, an authenticated user with permission to change issues can use the API to edit, close, or de...
EUVD-2026-114804
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels a...
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...
CVE-2026-118394
The Gitea OAuth2 userinfo endpoint (/login/oauth/userinfo) is vulnerable to private group disclosure due to incorrect authorization logic. The system incorrectly re-parsed the Authorization header as an OAuth2 access token instead of using the scope of the authenticating credential. Consequently,...
EUVD-2026-114802
The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...
CVE-2026-117646
In Gitea , certain tabs on user profiles (repositories, stars, and watching) and organization home pages fail to validate whether a request uses a personal access token restricted to public resources (public-only). This allows a token holder to list the owner's private repositories and their star...
EUVD-2026-114798
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources public-only. A holder of such a...