ODBParser

| ODBParser ---|--- TL;DR ODBParser is a tool to search for PII being exposed in open databases. ONLY to be used to identify exposed PII and warn server owners of irresponsible database maintenance OR to query databases you have permission to access! PLEASE USE RESPONSIBLY What is this? Wrote thi...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

CVE-2023-35078-Exploit-POC

CVE-2023-35078 POC d'exploitation La vulnérabilité CVE-2023-35078, qui permet un accès non authentifié à distance à l'API, a été découverte dans Ivanti Endpoint Manager Mobile EPMM, anciennement connu sous le nom de MobileIron Core. Cette vulnérabilité affecte toutes les versions prises en charge...

CVE-2024-33676

CVE-2024-33676 Authentification et autorisation faibles sur le chargeur EV Enel X JuiceBox Level 2 permettant l'accès aux fonctions et paramètres du système d'exploitation. Description Les utilisateurs sur le réseau WLAN local du chargeur EV peuvent extraire des informations personnelles PII,...

vibe-coding-security

Vibe Coding Security Avant de tweeter votre lancement, exécutez ces 69 vérifications. Elles correspondent aux schémas exacts à l'origine de la CVE Lovable RLS CVE-2025-48757, 170+ applications, 2025, de la fuite Moltbook 1,5 million de jetons API, février 2026 et de la brèche de la plateforme...

OWASP-Model-Card-Security-Standard

Statut : Brouillon — Projet OWASP en incubation Cette norme est en cours de développement actif. Les contributions et les retours sont les bienvenus. Qu'est-ce que c'est ? Lorsque vous téléchargez un modèle pré-entraîné depuis HuggingFace ou tout autre dépôt, vous faites essentiellement confiance...

EUVD-2026-81277

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2026-92577 AVideo through 29.0 API get_api_video Broken Access Control via clean_title

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2025-66698

CVE-2025-66698 Целевое ПО: Veda Semantic Machines v5.4.8 вероятно, все предыдущие версии. Тип уязвимости: Обход аутентификации. Идентификатор CVE: CVE-2025-66698. Краткое описание: Система некорректно проверяет параметр ticket, считая пустую строку действительной сессией. Ссылка на проект: Veda...

CVE-2026-88065

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-88065

tts-be is a backend service for a university timetable selector application. Versions prior to 2.1.0 contain a Broken Access Control vulnerability affecting multiple API endpoints, including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata. By chaining these unauthenticated end...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2022-0482_exploit

CVE-2022-0482 Vulnerability Exploitation Introduction This document outlines the detailed analysis of CVE-2022-0482, a critical security vulnerability identified in the Easy!Appointments scheduling software. This flaw, related to Incorrect Authorization under CWE-863, allows unauthorized access t...

bug-bounty-findings-o-research-disclosures.

bug-bounty-findings-o-research-disclosures. Bug Bounty : CVE-2023-50839 IDOR identifié dans un composant de support tiers via 'gau' et 'Nuclei'. Malgré des redirections périphériques, le logiciel obsolète restait exposé. Confirmé par une analyse manuelle des en-têtes. Sévérité : 5.3 Moyen. Axé su...

CVE-2026-19439

CVE-2026-19439 affects the Ultimate Gift Cards for WooCommerce WordPress plugin (versions 3.0.3 through 3.2.9 ). The root cause is a missing authorisation check in the wps_uwgc_report_details endpoint, which allows unauthenticated users to retrieve gift cards attached to arbitrary orders. This di...

PT-2026-89401

🚨 CVE-2026-88890 OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root...

CVE-2026-78216

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

CVE-2026-78216

AshLua (an Elixir library exposing Ash read actions to Lua scripts via an eval action) contains a field-policy bypass in its aggregate read operations (list, min, max, first, sum, avg). Ash field policies redact forbidden fields on returned records, but that redaction does not apply to aggregate ...

CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...