CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Vulnerabilidad BOLA en Indico Descubrió y reportó una vulnerabilidad BOLA en Indico. 📜 Descripción de CVE-2024-50633 Una vulnerabilidad de Autorización de Objetos a Nivel Roto BOLA en Indico v3.2.9 permite a atacantes acceder a información sensible de usuarios...

CVE-2024-33453

CVE-2024-33453 通过对象级访问控制导致敏感数据泄露（esp-idf） 描述 esp-idf 框架版本 5.1 中存在一个缓冲区溢出漏洞，该框架被某些 Schoolbox 产品使用，允许远程攻击者通过不当的对象级访问控制获取敏感信息。此漏洞通过操纵与 externalId 组件关联的 id 参数触发，导致未授权访问敏感数据。 附加信息 esp-idf 框架的 externalId 组件存在一个漏洞，导致对象级访问控制不当。此问题允许经过身份验证的用户通过更改 URL 中的 id 参数来访问属于其他用户的数据。 漏洞 URL 示例 经过身份验证的用户可以更改 URL 中的 id...

CVE-2021-38314

CVE-2021-38314 未认证敏感信息泄露（CVE-2021–38314）。...

CVE-2024-36991

CVE-2024-36991 Windows 上 Splunk Enterprise 版本低于 9.2.2、9.1.5 和 9.0.10 中的路径遍历漏洞，允许读取敏感文件。...

CVE-2023-33409

CVE-2023-33409 Minical 1.0.0 is vulnerable to Cross-Site Request Forgery. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC The application does not have any CSRF protection, hence a specially crafted HTTP request can be used to, Add New User Delete Existin...

cover

Cover Keep private data, internal infrastructure and secrets out of cloud coding agents without breaking your workflow. Install · Quick start · Policies · Monitoring · Pi / OMP · Security Cover is a bidirectional privacy proxy for AI coding agents. It replaces matched sensitive values locally wit...

CVE-2026-97307

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17...

CVE-2026-97307

The StylemixThemes Cost Calculator Builder WordPress plugin (versions up to and including 4.0.17 ) is vulnerable to an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This flaw allows an attacker to Retrieve Embedded Sensitive Data from the application. No specific expl...

EUVD-2026-92091

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17...

CVE-2026-97307 WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...

WordPress Five Star Business Profile and Schema plugin 2.3.20-2.3.21 - Author+ Sensitive Data Disclosure vulnerability

Author+ Sensitive Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin Five Star Business Profile and Schema versions 2.3.20-2.3.21...

CVE-2026-86817 Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2024-46987

CVE-2024-46987: 自动化路径遍历 📖 概述 此仓库包含一个基于Python的概念验证（PoC），针对CVE-2024-46987 。此漏洞是某些CMS环境（特别是Camaleon CMS 2.9.0版本）的文件下载模块中发现的路径遍历缺陷。 该脚本通过绕过标准路径规范化，自动检索敏感系统文件（如/etc/passwd或SSH私钥）。 🛠️ 技术细节 该漏洞的存在是因为应用程序接受一个file参数，并将其附加到目录字符串上，但未进行充分的清理。 此PoC使用requests.Session对象和预准备请求（Prepared Requests）...

Tenda 11N - Authentication Bypass

Tenda 11N with firmware version V5.07.33cn contains an authentication bypass vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-42233 info: name: Tenda 11N -...

Gitea <1.16.5 - Open Redirect

Gitea before 1.16.5 is susceptible to open redirect via GitHub repository go-gitea/gitea. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-1058 info: name: Gitea 1.16.5 - Open Redire...

MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

Traggo Server - Local File Inclusion

traggo/server version 0.3.0 is vulnerable to directory traversal. id: CVE-2023-34843 info: name: Traggo Server - Local File Inclusion author: DhiyaneshDk severity: high description: | traggo/server version 0.3.0 is vulnerable to directory traversal. impact: | Successful exploitation of this...