CVE-2026-108797

A vulnerability exists in ZKTeco BioTime version 9.5.6 Build 20260130.3206 within the Employee REST API component. Specifically, unknown code in the file /personnel/api/employees/ is susceptible to manipulation, leading to an authorization bypass . This attack can be initiated remotely . No speci...

CVE-2026-108797 ZKTeco BioTime Employee REST API employees authorization

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

EUVD-2026-97168

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was...

CVE-2026-108797 ZKTeco BioTime Employee REST API employees authorization

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

PT-2026-110912

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.22.0 Description Apache Allura contains a mass assignment issue within its REST API. Mass assignment occurs when an application takes user-provided input and binds it directly to an internal object or database...

CVE-2026-108797: Authorization Bypass Through User-Controlled Key

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

PT-2026-110437

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description An authorization bypass exists in the Employee REST API component. A remote attacker can manipulate the '/personnel/api/employees/' endpoint to bypass security checks. Recommendation...

CVE-2026-92119: Improperly Controlled Modification of Dynamically-Determined Object Attributes

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

restler-fuzzer

RESTler ¿Qué es RESTler? RESTler es la primera herramienta de fuzzing de API REST con estado para probar automáticamente servicios en la nube a través de sus API REST y encontrar errores de seguridad y confiabilidad en estos servicios. Para un servicio en la nube dado con una especificación OpenA...

sqlipy

sqlipy SQLiPy es un plugin de Python para Burp Suite que integra SQLMap usando la API de SQLMap. SQLMap viene con un servidor basado en RESTful que ejecutará escaneos de SQLMap. Este plugin puede iniciar la API por ti o conectarse a una API ya en ejecución para realizar un escaneo. Requisitos...

CVE-2026-81649

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

burpcommander

burpcommander Interfaz de línea de comandos en Ruby para la API REST de Burp Suite Uso burpcommander VERSIÓN: 1.0.1 - ACTUALIZADO: 29/08/2018 -t, --target Dirección IP Por defecto 127.0.0.1 -p, --port Número de puerto Por defecto 1337 -k, --key Clave API Si necesita una clave API, especifíquela...

Astra

Astra Las pruebas de penetración de API REST son complejas debido a los cambios continuos en las API existentes y las API recién agregadas. Astra puede ser utilizado por ingenieros de seguridad o desarrolladores como parte integral de su proceso, permitiéndoles detectar y corregir vulnerabilidade...

CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

EUVD-2026-96752

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-81649

The Fundiin for WooCommerce WordPress plugin, in versions up to and including 3.4.0 , suffers from a critical improper authorization vulnerability on several REST API routes . The flaw stems from the plugin relying on a hardcoded credential that is identical across all installations. This allows ...

caronte

caronte$ Caronte es una herramienta para analizar el flujo de red durante eventos de capture the flag de tipo ataque/defensa. Reensambla los paquetes TCP capturados en archivos pcap para reconstruir las conexiones TCP y analiza cada conexión en busca de patrones definidos por el usuario. Los...

trape

trape estable v2.0 Rastreador de personas en Internet: Aprende a rastrear el mundo para evitar ser rastreado. Trape es una herramienta de análisis e investigación OSINT que permite a las personas rastrear y ejecutar ataques inteligentes de ingeniería social en tiempo real. Fue creada con el...

PT-2026-110026

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...