Remove-IIS-RIIS

Remove-IIS-RIIS- CVE-2015-1635...

PT-2026-113674

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts the...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

CVE-2026-108882 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete...

cve-2019-1040-scanner

Escáner de CVE-2019-1040 Comprueba la vulnerabilidad CVE-2019-1040 sobre SMB. El script establecerá una conexión con el/los hosts objetivo y enviará una autenticación NTLM inválida. Si esta es aceptada, el host es vulnerable a CVE-2019-1040 y puedes ejecutar el ataque MIC Remove con ntlmrelayx. T...

EUVD-2026-96601

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

EUVD-2026-96576

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

EUVD-2026-96577

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user fr...

CVE-2026-108662

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108638

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user fr...

CVE-2026-108662 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108662 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108662

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the /sys/tenant/deleteTenantPackUser endpoint. This vulnerability allows low-privileged authenticated users to perform unauthorized actions by supplying arbitrary userId and packId values in a PUT re...

CVE-2026-108638 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user fr...

CVE-2026-108638 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user fr...

CVE-2026-108638

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController component. Specifically, the deleteGroupUser handler fails to perform ownership or tenant checks, allowing low-privileged authenticated users to issue DELETE requests with arbitrary groupId an...

CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...

CVE-2026-108637

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the deleteUserGroupBatch endpoint. A low-privileged authenticated user can call DELETE /sys/user/deleteUserGroupBatch to remove user group members by providing any groupId and comma-separated userIds. This allows t...

CVE-2026-108638: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user fr...

PT-2026-109899

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove group memberships due to missing authorization. This occurs via the deleteGroupUser handler in SysUserController. An attacker can send DELETE requests...