428112 matches found
CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes
ConcreteCMS Stored XSS v.9.2.1 Autore: Sergio Descrizione: Vulnerabilità di Cross Site Scripting multipla in ConcreteCMS v.9.2.1 permette a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nei Codici di tracciamento dell'intestazione e del piè di pagina d...
CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension
CMSmadesimple Stored XSS v2.2.18 Autore: Sergio Descrizione: Vulnerabilità Cross Site Scripting in CMSmadesimple v.2.2.18 che consente a un attaccante locale di eseguire codice arbitrario tramite uno script appositamente creato nei Profili dell'editor Extensions - MicroTiny WYSIWYG. Vettori di...
CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation
Cmsmadesimple CMS Reflected XSS v2.2.18 Autore: Sergio Descrizione: Multiple vulnerabilità Cross-Site Scripting XSS nell'installazione di cmsmadesimple v.2.2.18 permettono a un attaccante locale di eseguire script web arbitrari tramite un payload manipolato iniettato nel Nome del Database, Utente...
CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content
CSZ CMS XSS Memorizzato v1.3.0 Autore: Sergio CVE: 2023-41436 Descrizione: La vulnerabilità di Cross Site Scripting in CSZCMS v.1.3.0 consente a un utente malintenzionato locale di eseguire codice arbitrario tramite uno script appositamente predisposto nel parametro Additional Meta Tag nel...
goshs v2.1.6
You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...
detect-cve-2024-4367
Rileva CVE-2024-4367 Regola di rilevamento YARA rapida e sporca per l'esecuzione arbitraria di JavaScript in PDF.js CVE-2024-4367. Utilizzo root@kitploit: $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf Crediti POC e divulgazion...
CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...
EUVD-2026-66224
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...
CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...
CVE-2026-80202
Kimai before 2.56.0 has an authorization bypass in TimesheetVoter::voteOnAttribute() , which maps permissions only to own_timesheet or other_timesheet without enforcing team-membership checks. Any authenticated user holding ROLE_TEAMLEAD (or a role with edit_other_timesheet/delete_other_timesheet...
CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...
EUVD-2026-66218
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-80196
Kimai before 2.58.0 is affected by an authentication bypass in its password reset mechanism. The root cause is that the LoginLink signature covers only the user ID and not the password hash, meaning a password reset link remains valid after the user changes their password. An attacker who interce...
CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...
CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry
Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...
CVE-2026-80193
Kimai before 2.62.0 is affected by an authorization bypass in the QuickEntry controller . The root cause is a missing validation of the create_other_timesheet permission when creating new timesheets. Authenticated users who hold only view_other_timesheet and edit_other_timesheet permissions can c...
CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry
Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...
CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry
Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...