CVE-2025-8723

⚡️ Cloudflare Image Resizing Description: The plugin's REST API endpoint fails to authenticate users and improperly sanitizes input in the hookrestpredispatch method. This flaw enables attackers to inject and execute arbitrary PHP code by crafting malicious requests — with no login required. 🛠...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

CVE-2019-9653

CVE-2019-9653 Date Disclosure: 03/11/2019 Last updated: 03/15/2019 Summary NUUO Inc. is a company providing a video-centric surveillance solution. They have many NVR Network Video Recorder products for different customers with various requirements. These NVRs are Linux embedded video recording...

CVE-2026-56164-EXP

Microsoft SharePoint Server Elevation of Privilege - CVE-2026-56164 Functional unauthenticated EOP exploit. Overview Missing authentication for critical function CWE-306 in SharePoint Server user profile and site collection endpoints. Allows remote attackers to escalate from anonymous to Site...

360WFP_Exploit

360WFPExploit A proof-of-concept PoC demonstrating potential abuse of the 360 Security WFP driver 360netmonx64wfp.sys interface, aimed at verifying the risk that IOCTL interfaces without caller authentication may be misused by third-party programs. This project is intended for security research a...

CVE-2026-39987-Marimo-Preauth-RCE

CVE-2026-39987 – Marimo Pre-authentication RCE Research Security research and experimental validation of CVE-2026-39987, a missing authentication vulnerability affecting Marimo's terminal WebSocket endpoint. This project documents the vulnerability's root cause, local reproduction results, offici...

KOMTEK Cassa Kurier Module Authentication Bypass

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

Ascon.Pilot.WinService Authentication Bypass

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...

Ascon.Pilot.WinService Auth Bypass Code Execution

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

papercut-toolkit

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A defensive toolkit to check and understand exposure to the chained pre-auth remote code execution vulnerabilities in PaperCut: CVE-2026-81578 — Missing Authentication for Critical Function CWE-306. A remote unauthenticated request can...

Docker-Proxy hubcmdui - Missing Authentication on /api/config

Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structur...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery

Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost without validating a token when none is configured, which is the default state, letti...

NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

SAP_EEM_CVE-2020-6207

PoC for CVE-2020-6207 Missing Authentication Check in SAP Solution Manager This script allows to check and exploit missing authentication checks in SAP EEM servlet tcsmdagentapplicationeem that lead to RCE on SAP SMDAgents connected to SAP Solution Manager Original finding: Pablo Artuso Yvan 'igg...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. SYSTEM ANALYSIS Identifying the Attack Surface from the Docker Environment Starting with what is running in the environment. We list all active containers: docker ps Result: Container p1/lab10:latest is running, exposing 2 ports externally: Port mapping| Protocol ---|---...