Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management related to the lack of authentication for critical functions, allowing attackers to compromise the integrity and accessibility of protected information

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to execute arbitrary code.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system, which stems from the lack of authentication for a critical function, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to compromise the confidentiality, integrity, and accessibility o...

CVE-2019-7642

CVE-2019-7642 Les routeurs D-Link dotés de la fonctionnalité mydlink ont certaines interfaces web sans exigences d'authentification. Un attaquant peut obtenir à distance les journaux de requêtes DNS et les journaux de connexion des utilisateurs. Les cibles vulnérables incluent, sans s'y limiter,...

360WFP_Exploit

360WFPExploit Une preuve de concept PoC démontrant l'abus potentiel de l'interface du pilote WFP de 360 Security 360netmonx64wfp.sys, visant à vérifier le risque que les interfaces IOCTL sans authentification de l'appelant puissent être utilisées de manière abusive par des programmes tiers. Ce...

CVE-2026-105105

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker ait-server in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command a...

CVE-2026-105105

The NASA-AMMOS AIT-Core (versions through 3.1.1 ) is vulnerable to CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server ). The underlying cause is that the ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by d...

EUVD-2026-92014

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker ait-server in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command a...

CVE-2026-39987

CVE-2026-39987 — RCE без аутентификации в Marimo /terminal/ws CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Только для лабораторных работ / авторизованного тестирования HTB, CTF, работы в рамках...

cip-security-poc

cip-security-poc — доказательство принципа исправления CVE-2021-22681 а не только самой уязвимости Шесть исполняемых скриптов — реальный трафик протокола EtherNet/IP Тест 1, реальная механика TLS/PKI Тесты 3–6 — без единого компонента Rockwell или лицензий где-либо в цепочке. Создано для проверки...

CVE-2026-23744

CVE-2026-23744 : Exécution de code à distance non authentifiée dans @mcpjam/inspector AVERTISSEMENT : Ce dépôt et les scripts associés sont destinés uniquement à des évaluations de sécurité autorisées, des tests d'intrusion, de la recherche en sécurité et de l'analyse pédagogique. Tester des...

CVE-2026-39987

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypass poc Обзор Этот репозиторий содержит CVE-2026-39987 , затрагивающую marimo версий до 0.23.0. Уязвимость существует в конечной точке терминала WebSocket, где недостаточное обеспечение аутентификации может позволить...

MCP-Inspector-CVE-2025-49596

MCP Inspector Vérificateur de vulnérabilité CVE-2025-49596 Ce script vérifie si un serveur MCP Inspector est vulnérable à CVE-2025-49596, un problème de sécurité où le point de terminaison /sse répond aux requêtes non authentifiées jeton d'authentification manquant. Fonctionnement Le script envoi...

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter. id: CVE-2026-56270...

NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

CVE-2026-95102 Monta monta.app Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...