CVE-2026-24055-OAuth-Langfuse

CVE-2026-24055 — Unauthenticated Slack OAuth Install in Langfuse Course Project for Web and Application Security — Group 06, class NT213.Q21.ANTT 📌 Summary The project reproduces a real-world security vulnerability that has been publicly disclosed CVE-2026-24055 on the Langfuse platform — an OAut...

CVE-2022-45451

Introduction System Specs: Windows 10 1809 x64 EN Target: Acronis Home Cyber Protect Acronis Cyber Protect Vulnerability Description The Acronis "ngscan" anti-malware scan driver suffers from incorrect / improper access control placed on the filter communication port. The minifilter driver suppor...

WebminRCE-exploit

WebminRCE-exploit CVE-2022-0824, CVE-2022-0829 - File Manger privilege exploit Vulnerable application to test this PoC can be found here as a docker image. Prerequisites: Python3 Requests module Description Vulnerability Improper Access Control to Remote Code Execution Safe users Unpriviledged us...

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231...

CVE-2022-22063

CVE-2022-22063 CVE-2022-22063 is a security issue in the hypervisor firmware of some older Qualcomm chipsets. An unprotected hardware component the "boot remapper" can be abused to gain full read/write access to the hypervisor from a modified operating system privilege escalation. Exploiting the...

cve-2025-57819-freepbx-range

CVE-2025-57819 FreePBX Cyber Range Isolated educational cyber-range for CVE-2025-57819 CWE-89, CWE-288. Original FreePBX-compatible training application — not official Sangoma FreePBX. Quick start git clone https://github.com/shivammittal2403/cve-2025-57819-freepbx-range cd...

Webmin-CVE-2022-0824-revshell

Webmin-CVE-2022-0824-revshell Vulnerability Description Webmin 1.984 and below - File Manager privilege exploit CVE-2022-0824 and CVE-2022-0829 Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default...

CVE-2024-20767

CVE-2024-20767 CVE-2024-20767 - Arbitrary file system read using an Improper Access Control vulnerability in Adobe ColdFusion Please refer to ma4ter blogpost for more information: Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析 Products and Versions affected: Product| Affected Versions ---|--- ColdFusio...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion is a rapid development platform for building and deploying web and mobile applications. CVE-2024-20767 - ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file syst...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

WordPress WPQA <5.5 - Improper Access Control

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. id: CVE-2022-1598 info: name: WordPress WPQA 5.5 - Improper Access Control...

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...

Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control

Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-38817 info: name: Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control author: For3stCo1d...

Hermes WebUI < 0.51.788 - Remote Code Execution

Hermes WebUI 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials. id: CVE-2026-58123 info: name: Hermes WebUI 0.51.788 - Remote Code Execution...

RegistrationMagic <= 6.0.7.1 - Privilege Escalation

RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...

vCenter Server - Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...

CVE-2022-1388

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass RCE This Python script exploits CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST that allows unauthenticated remote command execution via improper access control and HTTP header handling. ⚠️ For educational and...

CVE-2020-11539

CVE-2020-11539: Improper Access Control in Tata Sonata Smartband Information Description: It has been identified that the smart band has no pairing mode 0 BLE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't hav...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...