483 matches found
FatPipe WARP/IPVPN/MPVPN - Authorization Bypass
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. id: CVE-2021-27858 info: name:...
CVE-2026-11106-DNS-Zone-Transfer-AXFR-Information-Disclosure
CVE-2026-11106 – DNS Zone Transfer AXFR Information Disclosure Program Code Python DNS Server + Attack dnsserversim.py - Simulated DNS server allowing AXFR from dnslib import DNSRecord, QTYPE, RR, TXT, A import socketserver, socket class DNSHandlersocketserver.BaseRequestHandler: def handleself:...
CVE-2019-7238
CVE-2019-7238 Nexus Repository Manager 3 Remote Code Execution without authentication 3.15.0 found by Rico Tencent Security Yunding Lab and @voidfyoo Detailed analysis english: https://chybeta.github.io/2019/02/18/Nexus-Repository-Manager-3-RCE-%E5%88%86%E6%9E%90-%E3%80%90CVE-2019-7238%E3%80%91/...
CVE-2025-29705
CVE-2025-29705 CVE-2025-29705 Introduction code-gen: A code generation tool that allows custom templates to generate different code, supporting MySQL, Oracle, SQL Server, PostgreSQL https://gitee.com/durcframework/code-gen This project has no access control, allowing anyone to freely access such...
CVE-2026-52729
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on PUT/DELETE /action/id allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privile...
EUVD-2026-112086
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
CVE-2026-50541
The Xibo open source digital signage platform is vulnerable to an IDOR (Broken Object-Level Authorization) flaw in versions prior to 4.4.3 . The root cause is missing access-control checks on the GET /dataset/export/csv/{id} endpoint, which allows an authenticated user to export data from any dat...
CVE-2026-52729
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on "PUT/DELETE /action/id" allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the...
CVE-2026-50541: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
PT-2026-128246
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
CVE-2026-114388
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
CVE-2026-114388
The Chamilo LMS software (versions 2.0.0-alpha.1 before 2.0.0-RC.3 ) contains a missing authorization vulnerability within the GradebookController . This flaw allows unauthenticated users to modify gradebook certificates by requesting the set_default_certificate endpoint using arbitrary course an...
CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
CVE-2026-114388
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
EUVD-2026-107235
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...
PT-2026-120575
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set default certificate endpoint with any course id and document ...
CVE-2026-92539
A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management SCIM API. This allows an authorized...
