CVE-2026-6470

A flaw was found in PostgreSQL where missing authorization checks in DDL commands allow an authenticated user to create unauthorized dependencies on a data type such as when assigning a range subtype or referencing the type in an SQL expression. This allows the user to block legitimate owners fro...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

CVE-2024-35511

PHPGurukul Men Salon Management System 2.0 Welcome to the PHPGurukul Men Salon Management System 2.0 repository. This project aims to provide a robust system for Men Salon Management. Security Vulnerabilities CVE-2024-35511 Description: Vulnerable to SQL Injection via 'username' parameter. Affect...

CVE-H3C-Report

H3C GR series router system management has unauthorized access vulnerability Product : GR series router version : all rating : high-risk website : http://www.h3c.com/ Hazards : Attackers can exploit this vulnerability to obtain sensitive information from routers by constructing special request...

CVE-2026-84217

CVE-2026-84217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Classified Listing by Mamunur Rashid, affecting versions from unknown (n/a) through 6.1.1 . The flaw allows authenticated low-privilege users to access functionality not properly constrained by...

CVE-2022-29464

CVE-2022-29464 Introduction Critical WSO2 vulnerability CVE-2022-29464 was found by Orange Tsai. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to submit malicious JSP files to WSO2 servers and get Remote Code Execution RCE. Disclaimer: Educationa...

CVE-2018-1305

Apache Tomcat Security Bypass Vulnerability Recently, Apache released a security advisory stating that multiple versions of Apache Tomcat 7, 8, and 9 have a security bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized operations,...

CVE-2023-29923-Scan

CVE-2023-29923-Scan Herramienta de detección de vulnerabilidad de acceso no autorizado en PowerJob =4.3.2 CVE-2023-29922...

CVE-2023-1454-EXP

CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Unauthorized SQL injection vulnerability JeecgBoot is a low-code development platform based on a code generator. The latest unauthorized SQL injection in the Java low-code platform jeecg-bootv3.5.0 for enterprise web applications. In addition to exploiti...

CVE-2022-47130

CVE-2022-47130 Academy LMS history.pushState'', '', '/'...

CVE-2024-43998

CVE-2024-43998 Description CVE-2024-43998 : Missing Authorization vulnerability in the Blogpoet theme allows access to functionality not properly constrained by ACLs. This issue affects Blogpoet versions from n/a through 1.0.3. Usage root@kitploit: usage: CVE-2024-43998.py -h -u URL -p PLUGIN...

CVE-2024-30485

CVE-2024-30485 エクスプロイト 📌 概要 CVE-2024-30485 は、WordPress 用 Finale Lite プラグイン バージョン = 2.18.0 で発見された深刻度の高い脆弱性です。この脆弱性により、認証されたユーザー Subscriber 以上 は、適切な認可なしに任意のプラグインをインストールおよび有効化できます。 深刻度 : 高 CVSS 8.8 影響を受けるバージョン : Finale Lite = 2.18.0 CWE : CWE-862 認可の欠如 🚀 機能 ✅ WordPress サイトが脆弱かどうかを確認 ✅ 有効な資格情報で認証 ✅...

CVE-2025-4162030

Security Advisory: CVE-2025-4162030 This security summary was provided by CoPilot ^1^. The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Unauthenticated Arbitrary Plugin Installation Description The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and...

CVE-2023-43317

CVE-2023-43317 A normal user can elevate their privileges via the userPermissionsLIst parameter in Session Storage component. to gain unauthorized access to administrative-level resources and features. This could lead to unauthorized data access, data modification, and other actions that are...

CVE-2020-11444

CVE-2020-11444 Nexus 3 Unauthorized Access Exploit Script For more exploit scripts, see: https://github.com/zhzyker/exphub Readme root@kitploit: +-----------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub...

CVE-2026-26418

CVE-2026-26418 Web API 中缺失的身份验证与授权 漏洞摘要 在 塔塔咨询服务公司（TCS）– Cognix Recon Client v3.0 的 Web API 层中发现了一个缺失身份验证与授权的漏洞。 部分暴露的 API 端点未强制执行适当的身份验证和授权控制，允许在未经适当验证的情况下远程访问应用程序功能。 技术分类（CWE） CWE-306 – 关键功能缺少身份验证 CWE-862 – 缺少授权 受影响的端点 http://clientreconhost/reconciliations/ http://clientreconhost/Scheduler/...

ActiveMQ_putshell-CVE-2016-3088

ActiveMQputshell-CVE-2016-3088- ActiveMQputshellでwebshellを直接取得 使い方： python3 ActiveMQputshell.py -u url...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

CVE-2022-1388-EXP

CVE-2022-1388-EXP This is CVE-2022-1388-EXP Author:Caps@BUGFOR Github:https://github.com/bytecaps Remaker:LinJacck Github:https://github.com/LinJacck Feature Display Verification mode: python CVE20221388.py -v -u targeturl Attack mode: python CVE20221388.py -a -u targeturl -c command Batch...