CVE-2026-0257

CVE-2026-0257: Bypass di Autenticazione GlobalProtect Panoramica Questo exploit consente l'accesso VPN non autenticato a un gateway/portale Palo Alto GlobalProtect forgiando un cookie di autenticazione utilizzando esclusivamente il certificato TLS pubblicamente disponibile del server. La...

EUVD-2026-64705

NewSiteServer NSS developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school...

poc-2025-9074

CVE-2025-9074 | Docker API CVE-2025-9074 PoC Prova di concetto Un sofisticato framework di exploitation per CVE-2025-9074, che prende di mira endpoint Docker API non autenticati, dotato di una shell interattiva integrata per l'esecuzione dei comandi. Panoramica Questo strumento automatizza lo...

CVE-2026-39987

CVE-2026-39987 - Bypass dell'autenticazione WebSocket del terminale marimo poc Panoramica Questo repository contiene CVE-2026-39987 che interessa le versioni di marimo precedenti alla 0.23.0. La vulnerabilità è presente nell'endpoint WebSocket del terminale, dove un'applicazione insufficiente...

wp2shell-lab

wp2shell-lab PoC e laboratório educativo para CVE-2026-63030 + CVE-2026-60137 : injeção SQL pré-autenticação no core do WordPress via confusão de rota batch. Descoberto por Adam Kues Searchlight Cyber / Assetnote. Corrigido no WordPress 6.9.5 / 7.0.2. Início rápido root@kitploit: iniciar o...

PT-2026-79818

Name of the Vulnerable Software and Affected Versions 4MOSAn GCB Doctor affected versions not specified Description An OS Command Injection issue exists where unauthenticated remote attackers can execute arbitrary system commands on the server. This is possible through a parameter in an unremoved...

PT-2026-81046

Name of the Vulnerable Software and Affected Versions WooBeWoo Product Filter Pro versions prior to 3.1.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes t...

PT-2026-79837

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...

PT-2026-80888

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows a...

CVE-2025-34171

CVE-2025-34171: Esposizione non autenticata di file e dati di debug in CasaOS Panoramica della vulnerabilità Campo| Valore ---|--- ID CVE| CVE-2025-34171 Interessa| CasaOS ≤ 0.4.15 Corretto in| Nessuna patch disponibile Gravità| Media CVSS 4.0|...

CVE-2025-67160

CVE-2025-67160 — Vatilon-basierte IP-Kameras Zusammenfassung Die Firmware von IP-Kameras auf Vatilon-Basis legt mehrere interne Webverzeichnisse offen, ohne dass eine Authentifizierung erforderlich ist. Wenn die Verzeichnisindizierung auf dem eingebetteten Webserver aktiviert ist, können nicht...

CVE-2025-29927-PoC

CVE-2025-29927 - Bypass dell'autorizzazione del middleware Next.js PoC Questo repository contiene un exploit Proof of Concept PoC per CVE-2025-29927 , una vulnerabilità critica in Next.js che consente agli attaccanti di aggirare i controlli di autorizzazione abusando di un header HTTP specifico d...

MongoBleed-DFIR-Triage-Script-CVE-2025-14847

Eric Capuano1 ha pubblicato un eccellente blog su MongoBleed CVE-2025-14847 e sugli indicatori da tenere d'occhio. La PoC di Joe Desimone2 mostra esattamente come funziona lo sfruttamento della perdita di memoria e Kevin Beaumont3 ha un eccellente approfondimento sulla vulnerabilità vedi sezione...

CVE-2025-24893

CVE-2025-24893 PoC | XWiki Platform 15.10.10 - Esecuzione remota di codice Una vulnerabilità di categoria RCE Remote Code Execution, riscontrata quando attaccanti non autenticati possono eseguire codice Groovy arbitrario da remoto senza autenticazione né accesso preliminare Guest User. Di seguito...

Next.Js-middleware-bypass-vulnerability-CVE-2025-29927

Ein grundlegender Proof of Concept der CVE-2025-29927-Schwachstelle, die das Umgehen der Middleware-Skripte ermöglicht. Details: Hier lesen Dies verwendet Next.js Version 15.2.2. Die Schwachstelle ermöglicht es dem Benutzer, das Middleware-Skript zu umgehen, das die Verifizierung enthält, und auf...

XM_ONVIF_auth_bypass

CVE-2025-65856 - تجاوز المصادقة ONVIF على كاميرات IP XM 530 كود إثبات المفهوم Bash و Python لـ CVE-2025-65856 حيث أن تنفيذ ONVIF في كاميرات IP Xiongmai XM530 يسمح بالوصول غير المصادق عليه إلى معلومات الجهاز الحساسة وتدفقات الفيديو المباشرة: إثباتات المفهوم Curl إثبات المفهوم Python إثبات المفهوم...

CVE-2026-76601

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...