6970 matches found
CVE-2025-71460
Zipline versions before 4.2.1 are vulnerable to a missing authorization flaw in the /api/user/files/transaction endpoint. The root cause is the absence of ownership checks , which allows authenticated users to modify or delete files belonging to other users if they possess a target file ID. No sp...
CVE-2026-126313
Frappe HRMS version 16.0.0 before 16.20.1 is vulnerable to an authorization bypass due to a missing ownership check on certain record types. This flaw allows authenticated users with only the Employee role to create or modify draft records belonging to other employees or companies they do not bel...
CVE-2026-127086
The Ryot application (versions before 10.5.6 ) is vulnerable to an authorization bypass via the createOrUpdateCollection GraphQL mutation. An authenticated attacker who knows a target collection id can provide an updateId to trigger an unauthorized ownership reassignment. This allows the attacker...
PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass
PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass CWE-863. The deletion guard evaluates @push.user == currentuser || @push.deletablebyviewer. For anonymous pushes, @push.user is nil; for unauthenticated requests,...
Meta Box <= 4.16.2 - Arbitrary File Deletion
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...
EUVD-2026-124738
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...
CVE-2026-127212: dokploy: Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that…
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...
pwnfb50
pwnfb50 Transfer ownership of any FB50 smart lock to yourself CVE-2019-13143 PoC Video Usage $ python3 pwnfb50.py id mac Where id is your user ID, and the mac is your lock's MAC address...
OwnershipStealer
OwnershipStealer This C code is a console application that attempts to take ownership of a specified file. Code Logic The program first checks if a file name was specified as a command line argument, and if not, prompts the user to enter one. It then proceeds to try and take ownership of the file...
SearchIPOwner
SearchIPOwner - h3x0v3rl0rd - Example Usage: Single IP Query: python3 SearchIPOwner.py 8.8.8.8 Multiple IPs from a file: python3 SearchIPOwner.py iplist.txt Save to CSV: python3 SearchIPOwner.py iplist.txt -csv...
asnap
Asnap Description Asnap aims to render recon phase easier by providing regularly updated data about which companies owns which ipv4 or ipv6 addresses and allows the user to automate initial port and service scanning. █████╗ ███████╗███╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝████╗ ██║██╔══██╗██╔══██╗...
CVE-2026-117550
Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and...
CVE-2026-117550 Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8
Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and...
EUVD-2026-124603
Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and...
CVE-2026-120146
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL...
CVE-2026-120146
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL...
EUVD-2026-124420
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL...
CVE-2026-120146
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL...
CVE-2017-17562
CVE-2017-17562 not coded by me...
PT-2026-146083
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...