CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the...

PyNightmare

PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM fully written in python3 Explanation CVE-2021-36934 is a recently discovered vulnerability found by @jonasLyk allowing non-admin users to copy all registry hives which contain very private information like hashes which could lead to...

POC-CVE-2026-19626

CVE-2026-19626 — RCE in report generation authenticated, non-admin Status: CONFIRMED — pure-REMOTE, non-admin, REST-only 6.7.2-14.el9 lab, 2026-08-21. The weaponized chain this is what poc.py does: 1. login as any regular org user 2. POST /rest/group with name: "=system''" — braces/quotes accepte...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE Proof-of-concept for CVE-2026-44848 , a missing-authentication CWE-862 vulnerability in Portainer that lets a non-admin user with Docker endpoint access perform privileged Docker plugin operations → full host...

CVE-2024-42327

PoC and Exploit for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being calle...

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred THIS \space EXPLOIT \space MAY \space VIOLATE \space THE \space LAW.$$ $$\colorred\space YOU \space ARE \space RESPONSIBLE \space FOR \space YOUR \space ACTIONS.$$ $$\colorredDEMONSTRATION \space PURPOSE \space ONLY.$$ DESCRIPTION RCE by Non-Admin Users via CSRF in...

CVE-2021-42562

CVE-2021-42562: Improper Access Control in MITRE Caldera Caldera versions =2.8.1 does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components which should only be accessible by admin users. Vendor Disclosure: The...

dir-3040_dos

dir-3040 Denial of Service Dir-3060 might also be affected as they share many components from same firmware. Tested on latest firmware 1.20b03a hotfix ftp server user access page by default is configured for any user with write privileges to write directly to ram instead of restricting to usb...

CVE-2026-4762

A vulnerability to perform a privilege escalation attack on the server as a non-admin user...

EUVD-2026-120776

A vulnerability to perform a privilege escalation attack on the server as a non-admin user...

CVE-2026-4762

This vulnerability allows a non-admin user to perform a privilege escalation attack on the server. The issue is categorized under CWE-347 (Improper Verification of Cryptographic Signature). While the technical root cause and specific affected software versions are not detailed in the provided doc...

CVE-2026-4762

A vulnerability to perform a privilege escalation attack on the server as a non-admin user...

CVE-2026-123814 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123814 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123814 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123814: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

portainer-cve-2026-44848-checker

Portainer CVE-2026-44848 checker Non-destructive checker for CVE-2026-44848 / GHSA-rrmm-9v76-h3p4 : missing authorization on Portainer's Docker plugin proxy endpoints. The tool answers two questions: 1. Is the Portainer version in a published affected range? 2. Can a non-admin account with Docker...

CVE-2026-84990

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2025-13050 Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...