CVE-2023-46478

CVE-2023-46478 Minical 1.0.0은 IDOR 취약점이 있습니다. 공급업체: https://github.com/minical/minical 데모 애플리케이션: https://demo.minical.io/ PoC 1단계: 두 개의 사용자 계정을 만들었습니다. 사용자 A해커와 사용자 Bwalker-448입니다. 2단계: 사용자 B 계정으로 이동한 다음 회계 모듈로 이동하고 아무 ID나 클릭합니다. 3단계: 이제 "Edit Profile"을 클릭합니다. 이름 필드에 원하는 값을 입력하고 "Update"를 클릭한 후...

CVE-2025-66683

CVE-2025-66683 CarRentalMS v2.0의 관리자 프로필 업데이트 기능에 사이트 간 요청 위조CSRF 취약점이 존재합니다. 영향을 받는 엔드포인트는 CSRF 방지 조치를 구현하지 않아, 공격자가 조작된 HTML 콘텐츠를 통해 인증된 관리자를 대신하여 권한 없는 프로필 수정을 수행할 수 있습니다...

CVE-2026-84225

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...

CVE-2026-82302

CVE-2026-82302 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that allows an attacker with low privileges to modify configurations without proper authorization, via exploiting incorrectly configured access control security levels (CAPEC-180). The CVSS 3.1 score is 8.1 (HIGH) , wi...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Отсутствие проверки прав доступа, позволяющее неавторизованное ограниченное обновление опций Плагин Tutor LMS – eLearning and online course solution для WordPress уязвим к несанкционированной модификации данных из-за отсутствия проверки прав доступа в функции...

CVE-2024-55271

ジム管理システム CVE-2024-55271 PHPとMySQLを使用して構築されたジム管理システムです。 監査者 Shoaib Alam - LinkedInプロフィール 説明 プロフィール更新機能におけるCSRF脆弱性 ジム管理システムに、クロスサイトリクエストフォージェリ（CSRF）の脆弱性が確認されました。この問題は、ユーザーパネルのプロフィール更新機能に存在します。 このアプリケーションには現在、Anti-CSRFトークンが実装されていないため、クロスサイトリクエストフォージェリ（CSRF）攻撃に対して脆弱です。このセキュリティ上の弱点は、特に /profile.php...

CVE-2026-77125

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

Incorrect permission check in Appearance configuration page

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421. This allows attackers with Overall/Manage permission to modify Appearance configuration options they...

CVE-2026-73779

CVE-2026-73779 affects the AOS-CX switch operating system (HPE), where a set of vulnerabilities allows an unauthenticated remote actor on an adjacent network to circumvent existing authentication controls . Successful exploitation can lead to information disclosure , unauthorized modification , a...

CVE-2026-73779 Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

CVE-2026-73764

CVE-2026-73764 affects the operating system of HPE AOS-CX switches , where an unauthenticated actor from an adjacent network can bypass authentication controls, enabling unauthorized modification of resources and limited service disruption . The CVSS 3.1 score is 7.1 (HIGH) with an attack vector ...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

PT-2026-84482

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description Issues in the operating system of AOS-CX switches may allow an unauthenticated remote actor to bypass authentication controls. This could lead to the unauthorized modification of...

EUVD-2026-67003

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

EUVD-2026-64841

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

CVE-2026-4244

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...