CVE-2024-55963

CVE‑2024‑55963 Appsmith RCE PoC CVE‑2024‑55963 の PoC エクスプロイト。脆弱な Appsmith インスタンス上で任意のコマンドを実行したり、リバースシェルを生成します。 自動的に最新のサーバー（ environmentId 機能を持つ）とそれ以前の古い「レガシー」ビルドの両方を処理するため、v1.20 から最後の脆弱なリリース v1.51 までのすべてのバージョンで1つのスクリプトを使用できます。 クイックスタート root@kitploit: Run an arbitrary command default is id python3...

CVE-2026-77142

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77133

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77133

CVE-2026-77133 is a broken access control vulnerability in the TYPO3 extension femanager . When the profile edit plugin uses its default field configuration, it fails to restrict which frontend usergroups a logged-in user may assign to their own account, enabling self-service privilege escalation...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

EUVD-2026-65334

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-62183

CVE-2026-62183 — Apache Syncope ユーザーセルフサービス権限昇格 Apache Syncope における不適切な権限管理 CWE-269 。認証済みの低権限ユーザーが、ユーザーセルフサービス API を通じて任意のロール （およびグループメンバーシップ、外部リソース、新しいレルム）を自身に付与できます — 他のすべてのコードパスでは管理エンタイトルメントが必要な操作 — それによりアイデンティティストアの管理者になることができます。 このリポジトリは、この脆弱性の技術リファレンス です:...

CVE-2026-70855

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM component: Helpdesk/Training. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service...

EUVD-2026-61806

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM component: Helpdesk/Training. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.

Red Hat Developer Hub 1.10.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

EUVD-2026-47507

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Manager Self-Service. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-47286

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-62542

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite component: Self Service Benefits. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced...

CVE-2026-62470

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Manager Self-Service. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-61282

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite component: Self Service Benefits. Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced...

CVE-2026-61075

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-62542

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite component: Self Service Benefits. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced...

EUVD-2026-46164

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2026-62183 Apache Syncope: User self-service privilege escalation

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...