nfcgate

NFCGate ⚠️NFCGate is currently being falsely detected as "NGate" malware. Please seethis issue for up-to-date information.⚠️ NFCGate is an Android application meant to capture, analyze, or modify NFC traffic. It can be used as a researching tool to reverse engineer protocols or assess the security...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

CVE-2026-101775

A flaw was found in the MySQL Server replication component. An unauthenticated remote attacker with network access could exploit this vulnerability to create, delete, or modify critical database data. A successful attack can also lead to a Denial of Service DoS by causing the server to hang or...

CVE-2026-114633

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and...

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

EUVD-2026-107888

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and...

CVE-2026-114633

The software WWBN AVideo versions prior to 29.4.0 is vulnerable to an incorrect authorization vulnerability. An attacker with delegated Users Admin privileges can target administrator accounts through the confirmDeleteUser.json.php or userAddNew.json.php endpoints. Successful exploitation allows ...

Malware in peptide-modify

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-114388

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114393 Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

EUVD-2026-107240

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114393

Trudesk versions up to 1.2.11 are susceptible to an authorization bypass vulnerability (CWE-639) affecting the Ticket Update API Endpoints . The root cause is that the application only verifies the default tickets:update role grant, allowing any authenticated user to modify tickets outside of the...

CVE-2026-114388 Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

EUVD-2026-107235

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the setdefaultcertificate endpoint with any course id and document id...

CVE-2026-114388

The Chamilo LMS software (versions 2.0.0-alpha.1 before 2.0.0-RC.3 ) contains a missing authorization vulnerability within the GradebookController . This flaw allows unauthenticated users to modify gradebook certificates by requesting the set_default_certificate endpoint using arbitrary course an...

CVE-2026-96901 Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...

EUVD-2026-107045

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...

CVE-2026-96901 Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...

CVE-2026-96901

The Cart Abandonment Recovery for WooCommerce WordPress plugin, in versions before 2.2.0 , contains a vulnerability where it fails to verify the integrity of its cart-recovery token . The plugin still accepts an unsigned legacy token format , which allows unauthenticated attackers who possess a v...