Lucene search
+L

24273 matches found

Kitploit
Kitploit
added 2026/09/15 4:23 a.m.8 views

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

7.5CVSS8.1AI score0.01624EPSS
SaveExploits6References1
Kitploit
Kitploit
added 2026/09/15 1:42 a.m.7 views

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

9.8CVSS5.9AI score0.04156EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/15 1:20 a.m.6 views

EUVD-2026-78250

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS
SaveExploits0References5
CVE
CVE
added 2026/09/15 1:20 a.m.5 views

CVE-2026-91774

Yao through v1.0.0-rc22 suffers from a missing authorization check on the OpenAPI GET /user/teams/:id endpoint. The endpoint authenticates the caller but fails to verify team membership, allowing any logged-in user who knows a team identifier to retrieve full team records, including name, descrip...

5.3CVSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/15 12:45 a.m.9 views

CVE-2026-8239

CVE-2026-8239 CVE-2026-8239 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS 9.5.0 and earlier.The vulnerability exists in the /ccm/frontend/conversations/getrating endpoint, which allows an attacker to determine whether a conversation message exists and retrieve i...

6.3CVSS6.1AI score0.00195EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/09/15 12:00 a.m.6 views

PT-2026-91833

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/14 11:51 p.m.7 views

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

8.8CVSS7.7AI score0.01426EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/14 10:44 p.m.11 views

CVE-2025-2907

CVE-2025-2907 Exploit Details Published : 2025-04-04 Updated : 2025-03-28 Severity : Critical CVSS Score: 9.8 CWE : CWE-862: CWE-862 Missing Authorization Affected Versions : All versions from n/a through 12.3.1 Researcher :...

9.8CVSS8.1AI score0.01372EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/14 8:49 p.m.8 views

CVE-2022-36539

CVE-2022-36539 Insecure Direct Object Reference IDOR WeDayCare B.V. WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children. Traffic with the API is made transparent via a proxy such as Burp Suite...

7.5CVSS7.4AI score0.01535EPSS
SaveExploits1
EUVD
EUVD
added 2026/09/14 8:45 p.m.3 views

EUVD-2026-78090

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...

5.3CVSS
SaveExploits0References8
CVE
CVE
added 2026/09/14 8:45 p.m.5 views

CVE-2026-90820

a2aproject a2a-java 1.2.0 contains a missing authorization flaw in the AuthorizationRequestHandlerDecorator.onListTasks function (file: server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java). The vulnerability allows a remote attacker with...

5.3CVSS
SaveExploits0References8
CVE
CVE
added 2026/09/14 8:38 p.m.5 views

CVE-2026-81901

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID} ). The endpoint did not enforce page-property, page-template, or page-type authorization, allowing a user with only conten...

7.2CVSS
SaveExploits0References1
NVD
NVD
added 2026/09/14 7:17 p.m.5 views

CVE-2026-89023

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

8.8CVSS
SaveExploits0References2
NVD
NVD
added 2026/09/14 7:17 p.m.3 views

CVE-2026-82519

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

4.3CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/14 7:02 p.m.5 views

EUVD-2026-77771

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

4.3CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/14 7:02 p.m.6 views

CVE-2026-82519

The Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check in the profile-page update handler. An authenticated low-privileged attacker can submit a crafted POST request omitting the two-factor-authentication field, which skips nonce verification and trigg...

4.3CVSS
SaveExploits0References2
NVD
NVD
added 2026/09/14 6:20 p.m.3 views

CVE-2026-90806

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

6.5CVSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/14 6:17 p.m.7 views

EUVD-2026-77760

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

8.8CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/14 6:17 p.m.6 views

CVE-2026-89023

The ThemeAtelier Domain For Sale WordPress plugin, in versions before 3.5.2 , suffers from a missing authorization flaw in its REST API endpoints . Unauthenticated attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics that disc...

8.8CVSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/14 6:17 p.m.14 views

CVE-2026-89023 ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

8.8CVSS
SaveExploits0References2
Rows per page
Query Builder