112104 matches found
CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...
CVE-2022-3992
CVE-2022-3992 WonderCMS의 크로스 사이트 스크립팅XSS 설명: Sanitization Management System v1.0의 XSS크로스 사이트 스크립팅 취약점으로 인해 잠재적 공격자가 조작된 이름을 통해 System Info Fields의 시스템 로고 필드에 임의의 파일을 업로드할 수 있습니다. 쿠키에 HttpOnly 플래그가 없으므로 로그인한 사용자의 쿠키를 탈취하는 데 악용될 수 있습니다. 재현 방법:...
CVE-2024-7135
CVE-2024-7135 WordPress용 Tainacan 플러그인은 0.21.7 이하의 모든 버전에서 'getfile' 함수에 대한 누락된 권한 검사로 인해 데이터 무단 접근에 취약합니다. 이 함수는 또한 디렉터리 트래버설directory traversal에도 취약합니다. 이를 통해 Subscriber구독자 수준 이상의 접근 권한을 가진 인증된 공격자가 서버에 있는 임의의 파일 내용을 읽을 수 있으며, 해당 파일에는 민감한 정보가 포함될 수 있습니다. 사용법 WordPress CVE-2024-7135 Wordpress...
CVE-2026-97303
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2...
CVE-2026-97304
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...
CVE-2026-97309
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-103086
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
CVE-2026-102383
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...
CVE-2026-20253
CVE-2026-20253 — Splunk Enterprise 사전 인증 RCE 실습 환경 PostgreSQL 사이드카를 통한 인증 없는 임의 파일 생성 및 잘라내기 CVSS 9.8 · 치명적Critical · CWE-306 · 활발히 악용 중 CISA KEV ⚠️ 면책 조항 이 저장소는 교육 및 승인된 보안 연구 목적으로만 엄격히 제공됩니다. 모든 테스트는 본인이 소유했거나 명시적 서면 허가를 받은 인프라에 대해서만 수행해야 합니다. 저자는 여기에 시연된 기법이나 도구의 오용에 대해 어떠한 책임도 지지 않습니다. 소유하지 않은...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58865
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-92618
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58865
A vulnerability exists in multiple functions of PduParser.java due to a missing bounds check . This flaw can lead to a persistent denial of service (DoS) or a remote denial of service without requiring additional execution privileges or user interaction. No specific exploitation details are provi...
CVE-2026-45524
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-66391
このリポジトリには README がありません。...
CVE-2026-105638
The project management tool Plane is vulnerable to a 6-digit OTP brute force attack in versions prior to 1.4.0 . The magic-code email login verifier lacks a per-code failed-attempt counter, fails to invalidate Redis entries on incorrect attempts, and does not lock email addresses. Because the ver...
EUVD-2026-92594
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...
CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, ...