keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

Exploit for CVE-2026-12793

CVE-2026-12793 — JetFormBuilder Unauthenticated Privilege Esca...

Log4j-_Vulnerability

The Web Is Vulnerable to CVE-2021-44228 This web application is vulnerable to CVE-2021-44228, a critical security flaw in Apache Log4j 2 known as Log4Shell. This vulnerability allows unauthenticated attackers to remotely execute malicious code by sending specific input that is logged by the syste...

Blackash-CVE-2025-41115

🔐 CVE-2025-41115: Critical Grafana SCIM Privilege Escalation Critical SCIM Privilege-Escalation Vulnerability in Grafana Enterprise 🌟 Summary CVE-2025-41115 is a Critical CVSS 10.0 vulnerability in Grafana Enterprise affecting its SCIM user-provisioning feature. When SCIM provisioning is enabled...

Vulnerabilities in Oracle PeopleSoft Enterprise

Oracle has identified 16 vulnerabilities in various Oracle PeopleSoft products, including PeopleSoft Enterprise PeopleTools, PeopleSoft Enterprise P RTL Interaction Hub, and PeopleSoft Enterprise CC Common Application Objects. These vulnerabilities concern various security issues within Oracle...

Vulnerabilities in Oracle Analytics

Oracle has identified 50 vulnerabilities in various Oracle Analytics products, including Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher. These vulnerabilities concern various security issues in Oracle Analytics products, including possibilities for unauthorized and...

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

Summary The SSE transport mode SSE=true exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable...

GHSA-CV3R-C5H8-F4G5 @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

Summary The SSE transport mode SSE=true exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Kirki WordPress account security risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot...

CVE-2026-11374-check

CVE-2026-11374 ManageEngine AD360 Precondition Detection Script A detection script for the exploit precondition of CVE-2026-11374, a predictable SSO-ticket flaw that leads to unauthenticated account takeover across the ManageEngine AD360 suite. The four in-scope products share the...

CVE-2026-19632-POC

CVE-2026-19632 — TranslatePress Unauthenticated Account Takeover Unauthenticated Account Takeover via Password Reset Link Disclosure Contact TG:@soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN 🎥 Video...

CVE-2024-50478

CVE-2024-50478 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover Description: The 1-Click Login: Passwordless Authentication plugin for WordPress is vulnerable to authentication bypass in version 1.4.5. This is due to the plugin not properly verifying a...

Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks.

Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks. Simulation of the Zerologon CVE-2020-1472 vulnerability attack in Active Directory on Windows Server 2016 and the use of the Trend Micro Deep Security solution to prevent such attacks. The Zerologon vulnerability is a weakne...

westone-CVE-2020-14883-scanner

westone-CVE-2020-14883-scanner A remote attacker can construct a special HTTP request to take over the WebLogic Server Console without authentication. Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-14883-scanner.git cd westone-CVE-2020-14883-scanner cmd...

CVE-2023-51119

CVE-2023-51119 Improper Access Control on D-Link DIR-605L router Exploitation explanation: Due to an incorrect access control, a takeover can be done over the admin account without any kind of authentication sending a request under special circumstances only needs a legitimate admin to be logged ...

CVE-2022-22845-Exploit

CVE-2022-22845-Exploit Exploit for CVE-2022-22845 - Unauthenticated Admin Takeover On QXIP SIPCAPTURE Homer-App up to 1.4.27 Discovery: Omri Baso & Fabien Aunay Exploit Author: Omri Baso...

CVE-2025-4162029

Security Advisory: CVE-2025-4162029 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

CVE-2025-4162026

Security Advisory: CVE-2025-4162026 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — SiYuan MCP Unauthenticated Administrator Takeover Proof of Concept for CVE-2026-66012 CVSS 10.0 Critical, a missing-authorization vulnerability in SiYuan's MCP Model Context Protocol endpoint that allows an unauthenticated attacker to achieve administrator takeover and remote cod...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...