ODBParser

| ODBParser ---|--- In breve ODBParser è uno strumento per cercare PII esposti in database aperti. DA USARE SOLO per identificare PII esposti e avvisare i proprietari dei server di una manutenzione irresponsabile del database OPPURE per interrogare database a cui hai il permesso di accedere! PER...

vibe-coding-security

Sicurezza del Vibe Coding Prima di twittare il tuo lancio, esegui questi 69 controlli. Corrispondono esattamente ai pattern alla base della CVE RLS di Lovable CVE-2025-48757, 170+ app, 2025, della fuga di Moltbook 1,5 milioni di token API, feb 2026 e della violazione della piattaforma Lovable...

bug-bounty-findings-o-research-disclosures.

Segnalazioni di bug bounty o divulgazioni di ricerca. Bug Bounty: CVE-2023-50839 IDOR identificato in un componente di supporto di terze parti tramite 'gau' e 'Nuclei'. Nonostante i reindirizzamenti perimetrali, il software obsoleto è rimasto esposto. Confermato tramite analisi manuale degli...

CVE-2025-66698

CVE-2025-66698 Zielsoftware: Veda Semantic Machines v5.4.8 wahrscheinlich alle früheren Versionen. Schwachstellentyp: Authentifizierungsumgehung. CVE-ID: CVE-2025-66698. Zusammenfassung: Das System validiert den Ticket-Parameter nicht ordnungsgemäß und behandelt eine leere Zeichenfolge als gültig...

CVE-2023-35078-Exploit-POC

CVE-2023-35078 Exploit POC Die Sicherheitslücke CVE-2023-35078 Remote Unauthenticated API Access wurde im Ivanti Endpoint Manager Mobile EPMM, ehemals MobileIron Core, entdeckt. Diese Schwachstelle betrifft alle unterstützten Versionen – Version 11.4 sowie Releases 11.10, 11.9 und 11.8. Ältere...

OWASP-Model-Card-Security-Standard

Stato: Bozza — Progetto OWASP in fase di incubazione Questo standard è in sviluppo attivo. Contributi e feedback sono molto graditi. Che cos'è? Quando scarichi un modello pre-addestrato da HuggingFace o da qualsiasi altro repository, ti stai sostanzialmente fidando di una scatola nera. Non sai su...

CVE-2024-33676

CVE-2024-33676 Autenticazione e autorizzazione deboli sul caricatore EV Enel X JuiceBox Level 2 consentono l'accesso alle funzioni e ai parametri del sistema operativo. Descrizione Gli utenti sulla rete WLAN locale del caricatore EV possono estrarre PII, modificare le impostazioni e manipolare il...

CVE-2025-65681

CVE-2025-65681 Un problema è stato scoperto in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2, che permette ad aggressori locali non autorizzati di ottenere accesso a informazioni sensibili a causa dell'assenza di intestazioni HTTP cache-control adeguate e controlli di sessione lato client...

CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

CVE-2022-0482_exploit

Ausnutzung der Schwachstelle CVE-2022-0482 Einleitung Dieses Dokument beschreibt die detaillierte Analyse von CVE-2022-0482, einer kritischen Sicherheitsschwachstelle in der Terminplanungssoftware Easy!Appointments. Dieser Fehler, der unter CWE-863 als fehlerhafte Autorisierung eingestuft wird,...

EUVD-2026-63813

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

EUVD-2026-59859

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

CVE-2026-13358

The CVE concerns the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Affected: all versions up to and including 1.6.12.10. Issue: Insecure Direct Object Reference via the ssa_past_appointments key due to missing validation, allowing authenticated attac...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

PT-2026-73084

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa past appointments due to missing validation on a user controlled key. This makes it...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

PT-2026-71263

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...