58949 matches found
React Server Components - Remote Code Execution
React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...
Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection. id:...
CVE-2025-67159
CVE-2025-67159 — Vatilon-basierte IP-Kameras Zusammenfassung Die Firmware von Vatilon-basierten IP-Kameras enthält eine Authentifizierungsumgehung und Offenlegung von Klartext-Anmeldedaten in der API /cgi-bin/web.cgi. Die Weboberfläche verarbeitet Anfragen mit den Parametern username und password...
hikvision_CVE-2017-7921_auth_bypass_config_decryptor
hikvisionCVE-2017-7921authbypassconfigdecryptor यह पायथन फ़ाइल hikvision कैमरों द्वारा उपयोग किए जाने वाले configurationFile को डिक्रिप्ट करेगी जो CVE-2017-7921 के लिए संवेदनशील हैं। https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ विवरण Hikvision IP कैमरा प्रमाणीकरण...
CVE-2025-505050
CVE-2025- Beschreibung: unauthinticated access to uploaded files POC: navigate to any uploaded file it will be accesed without login Entdeckt von Aljohara Abdulmohsen Alsubaie...
CVE-2025-53694
CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...
CVE-2025-11171
CVE-2025-11171: ثغرة نقص المصادقة في إضافة Chartify لووردبريس الكلمات المفتاحية: CVE-2025-11171, ثغرة إضافة Chartify لووردبريس, نقص المصادقة, أمان ووردبريس, استغلال AJAX غير مصادق, ثغرة إضافة ووردبريس, CWE-306, ثغرة إضافة الرسوم البيانية لووردبريس, تجاوز المصادقة, CVE لووردبريس 2025 جدول المحتويا...
CVE-2026-10627
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2018-18441-exploit
CVE-2018-18441-exploit root@kitploit: Le telecamere Wi-Fi della serie D-Link DCS espongono informazioni sensibili riguardanti la configurazione del dispositivo. I dispositivi interessati includono molti della serie DCS, come: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L,...
CVE-2026-10627 Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-65271
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by molten bit in WordPress Plugin Events Manager versions = 7.4.0...
CVE-2026-10627
The Events Manager plugin for WordPress (versions up to and including 7.4.0 ) is vulnerable to an authorization bypass via the status , private , and private_only parameters, which are not properly validated. This allows unauthenticated attackers to view the titles, dates, descriptions, and locat...
CVE-2026-41940
CVE-2026-41940 - Bypass dell'autenticazione cPanel/WHM Questo repository contiene un report in inglese con dati oscurati e uno strumento di verifica basato su Go per CVE-2026-41940, un bypass dell'autenticazione cPanel/WHM causato dall'iniezione CRLF nella gestione dell'autenticazione Basic. Tutt...
CVE-2025-24893
CVE-2025-24893 XWiki – Proof of Concept für nicht authentifizierte Remote-Codeausführung Beschreibung der Schwachstelle XWiki Platform ist eine generische Wiki-Plattform, die Laufzeitdienste für darauf aufbauende Anwendungen bereitstellt. Jeder Gast kann über eine Anfrage an SolrSearch beliebigen...
CVE-2024-9106
CVE-2024-9106 Wechat Social login = 1.3.0 - Bypass dell'autenticazione Descrizione: Il plugin Wechat Social login per WordPress è vulnerabile al bypass dell'autenticazione nelle versioni fino alla 1.3.0 inclusa. Ciò è dovuto a una verifica insufficiente dell'utente fornito durante il login social...
EUVD-2026-65175
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
PT-2026-81516
Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw affected versions not specified Description NVIDIA NemoClaw for Linux contains a flaw in its inference server setup that allows a remote attacker to access the inference service without authentication. The issue occurs when the...
cve-2019-9053-py3
CVE-2019-9053 — Exploração SQLi no CMS Made Simple Python 3 Aviso: Esta ferramenta destina-se apenas a testes de penetração autorizados e fins educacionais. Executá-la contra sistemas sem permissão explícita por escrito é ilegal. O autor não assume nenhuma responsabilidade por uso indevido. Visão...