CVE-2025-31324

CVE-2025-31324 Ein Proof of Concept, entwickelt zur Ausnutzung von CVE-2025-31324. Usage usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help...

CVE-2018-10933

CVE-2018-10933 Eine Sicherheitslücke wurde in der server-seitigen Zustandsmaschine von libssh vor den Versionen 0.7.6 und 0.8.4 gefunden. Ein böswilliger Client könnte Kanäle erstellen, ohne zuvor eine Authentifizierung durchzuführen, was zu unbefugtem Zugriff führt. EINIGE DETAILS Das Problem...

crushftp-CVE-2025-2825

crushftp-CVE-2025-2825 A severe authentication bypass vulnerability has been discovered in CrushFTP! 💥 Attackers can potentially gain unauthorized access without needing valid credentials. What's the Danger? ⚠️ This flaw allows for complete authentication bypass, leading to data breaches,...

CVE-2024-43998

CVE-2024-43998 Beschreibung CVE-2024-43998 : Fehlende Autorisierungsschwachstelle im Theme Blogpoet ermöglicht Zugriff auf Funktionalität, die nicht ordnungsgemäß durch ACLs eingeschränkt wird. Dieses Problem betrifft Blogpoet-Versionen von n/a bis 1.0.3. Verwendung usage: CVE-2024-43998.py -h -u...

CVE-2020-13937

Apache Kylin API Unbefugter Zugriff Schwachstelle（CVE-2020-13937 Fofa:title="Kylin" Verwendung Hilfe: python3 cve-2020-13937.py --help Einzeltest: python3 cve-2020-13937.py -u http://127.0.0.1 Massentest: python3 cve-2020-13937.py -f target.txt...

CVE-2026-80047

A flaw was found in the Hugging Face Transformers library. A remote attacker could exploit this vulnerability by enticing a user to load a model using the GenerativePreTrainedModel.loadcustomgenerate function. This function writes remote Python files to the local disk without requiring explicit...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

Apache Superset - Authentication Bypass

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

Majordomo2 - SMTP/HTTP Directory Traversal

A directory traversal vulnerability in the listfileget function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. dot dot sequences in the help command, as demonstrated using 1 a crafted email and 2 cgi-bin/mjwwwusr in the web interface. id:...

EUVD-2026-91821

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

EUVD-2026-91822

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

EUVD-2026-91824

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

AlmaLinux 9.2 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / etc (ALMALINUX9.2:CLSA-2026:1790972556)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790972556 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

CVE-2026-95102

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

CVE-2026-94592

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-97212

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

CVE-2026-95102

The Monta monta.app software is vulnerable to Missing Authentication for Critical Function (CWE-306) within its WebSocket endpoints . The lack of proper authentication mechanisms allows attackers to impersonate charging stations, potentially leading to privilege escalation , unauthorized access t...

CVE-2026-95102 Monta monta.app Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...