202 matches found
CVE-2026-24061_Lab
CVE-2026-24061 Telnetd Lab Este repositorio contiene un laboratorio simple en Docker para demostrar la vulnerabilidad CVE-2026-24061. Permite eludir la autenticación y obtener acceso como root en GNU telnetd, en Linux. El objetivo es exclusivamente educativo. Requisitos Docker instalado Cliente...
EUVD-2026-93923
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7
CVE-2025-25749-HotelDruid-3.0.7中弱密码策略漏洞 描述 HotelDruid 3.0.7及更早版本存在一个漏洞，该漏洞因未强制执行密码强度策略，允许用户设置弱密码。 影响 接受弱密码： 攻击者可以通过猜测简单密码或使用凭据填充攻击获得高成功率。 凭据重用风险： 如果用户在多个系统中重复使用密码，攻击者可利用已泄露的凭据。 无密码时效： 频繁更改密码以规避检测成为可能。 攻击面扩大： 结合反射型XSS（CVE-2025-25747）等漏洞，攻击者更容易获得初始立足点。 风险摘要...
CVE-2026-104181
The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...
CVE-2026-74864: Authorization Bypass Through User-Controlled Key
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
PT-2026-86936
Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description The management API is served without authentication on all network interfaces by default, requiring no password on fresh installations. This allows attackers to access the unauthenticated...
UBUNTU-CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
Brazil Health Surveillance Database Exposed 79GB of Sensitive Records
Brazil's SISVISA health surveillance system left 102,215 files totaling 79GB open online, including tax IDs and identity documents, without password protection...
EUVD-2026-52409
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...
CVE-2026-67599
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...
CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in...
CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in...
CVE-2026-6890
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-51379
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
📄 WordPress Booking Activities 1.16.43 Authentication Bypass
WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...
CVE-2026-44986
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...
CVE-2026-44986 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...
FacturaScripts: Account takeover of any 2FA-enabled user
Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...
PT-2026-60077
Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...
CVE-2026-8926
When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...