Jrohy-trojan-unauth-poc

Jrohy/trojan: modificación no autorizada de la contraseña del administrador Jrohy/trojan es un proyecto de código abierto basado en Go para el despliegue automatizado de servicios trojan. Su endpoint de inicialización web /auth/register no se cierra correctamente después de la configuración del...

CVE-2018-7600

CVE-2018-7600 Drupalgeddon2 Exploit – Python3 DESCARGO DE RESPONSABILIDAD: Este proyecto es solo para fines educativos y de pruebas de penetración autorizadas. NO utilice este código en sistemas que no posea o para los que no tenga un permiso escrito explícito para probarlo. El uso no autorizado ...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: emisión de credenciales antes de la validación de ubicación en register Un reproductor autónomo de un solo comando para CVE-2026-64640 : los endpoints register de Iceberg REST en Apache Polaris generan credenciales de almacenamiento en la nube para una ruta...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

PT-2026-91935

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0 Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password...

CVE-2026-90523

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-90523

CVE-2026-90523 affects the jaychouchannel Tourism-Management-System GitHub project, specifically the User Register Endpoint in UsersController.java. The root cause is improper privilege management arising from manipulation of the UsersEntity argument, allowing a remote, unauthenticated attacker t...

CVE-2026-90523 jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-90523 jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

EUVD-2026-77021

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-90523 jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-90523: Improper Privilege Management

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

PT-2026-90860

Name of the Vulnerable Software and Affected Versions jaychouchannel Tourism-Management-System versions up to 229956e20dbd4a80eeff14535e44d3099502af09 Description Improper privilege management exists in the User Register Endpoint within the file...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

EUVD-2026-71124

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

PT-2026-85561

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model path parameter without authentication or path confinement. The endpoint reads and parses config.json...

CVE-2026-44506

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

EUVD-2026-70699

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...