CVE-2024-32371

CVE-2024-32371 描述 描述 标识为 CVE-2024-32371 的漏洞允许攻击者通过将 type 参数从 1 更改为 0 来提升权限。该漏洞使拥有普通用户账户的攻击者能够提升权限并获得系统的管理访问权限。 版本：发现于 HSC Mailinspector 5.2.17-3，但适用于直至 5.2.18 的所有版本。 易受攻击的参数 参数： type 受影响的值： 将值从 1（普通用户）更改为 0（管理员） 漏洞说明 该漏洞源于对 type 参数访问控制检查不充分。通过操纵请求负载中 type 参数的值，攻击者可以将其用户账户的权限从普通用户修改为管理员。 攻击场景...

CVE-2023-22515

红队工具-Confluence未授权添加管理员用户CVE-2023-22515漏洞利用工具 漏洞影响范围 root@kitploit: 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server = 8.2.3 8.3.0 = Confluence Data Center and Confluence...

CVE-2023-3460_POC

CVE-2023-3460 CVE-2023-3460 的利用程序 - Ultimate Member 插件的未授权管理员访问。使用 Golang 编写 root@kitploit: ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ 免责声明 ║ ║ 关于项目 ║ ║ ║ ║ ║ ║ 本概念验证（PoC）的开发 ║ ║ 在某些情况下，此利用程序会出问题。 ║ ║ 仅用于教育和研究目的。 ║ ║...

CVE-2019-16097

CVE-2019-16097 Principio de la vulnerabilidad de creación no autorizada de administrador en Harbor, docker y PoC basado en el framework pocsuite...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch 路由混淆 + SQL 注入 导致 未授权创建管理员 → 远程代码执行 的完整利用链 PoC。 仅供授权安全测试、漏洞复现与研究使用。禁止用于未授权目标。 漏洞概述 项目| 说明 ---|--- CVE| CVE-2026-63030 组件| WordPress Core REST API /batch/v1 影响版本| WordPress 6.9.0 – 6.9.4 、7.0.0 – 7.0.1 （以官方公告为准） 攻击前提| 目标开启 REST API batch；站点至少有一篇已发布的文章或页面 权限要求...

EUVD-2026-70667

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

EUVD-2024-55742

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2025-67651

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67651

The CVE-2025-67651 entry describes a Cross-Site Request Forgery (CSRF) flaw in multiple PHP Jabbers scripts. The root cause is missing CSRF tokens and/or improper SameSite attributes, allowing an attacker to perform actions in an authenticated user’s context, notably creating new admin accounts. ...

PT-2026-66749

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

PT-2026-63353

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.30.1 n8n versions prior to 2.29.8 Description The Token Exchange module assigns all Public API key scopes to issued JSON Web Tokens JWTs, ignoring the actual role of the acting user. In environments where the Token...

PT-2026-63432

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2026-21760

CVE-2026-21760 affects HCL DevOps Loop with an unauthorized access via forced browsing. The root cause is improper authorization checks that permit direct access to protected admin endpoints. CVSSv3.1 metrics indicate Network attack vector, Low privileges required, User interaction required, with...

CVE-2026-21760

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality Forced Browsing vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints...

EUVD-2026-45086

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...

CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...

CVE-2026-58319

CVE-2026-58319 concerns Apache Doris Frontend (FE) HTTP REST administrative APIs that were reachable without authentication. The available data states an unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially compromis...