EUVD-2026-97067

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

EUVD-2026-97048

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user...

EUVD-2026-97046

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

EUVD-2026-97049

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...

EUVD-2026-97047

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

EUVD-2026-96906

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...

CVE-2026-107761

The Postiz platform contains a vulnerability where several endpoints return complete database rows, exposing sensitive secrets. Specifically, the public API's channel delete endpoint returns the platform access and refresh tokens, allowing third-party OAuth apps with delete permissions to access ...

CVE-2026-108876

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the putCancelQuit handler of SysUserController. This flaw allows any authenticated user to cancel user resignations. By supplying specific user ids and a tenantId parameter (or X-Tenant-Id header), a l...

CVE-2026-108875

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController's addSysUserGroup handler. This vulnerability allows any authenticated user to perform unauthorized modifications to user group memberships by sending POST requests with arbitra...

CVE-2026-108874

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability. An authenticated user can call the PUT /sys/user/changeDepartChargePerson endpoint to assign or remove department heads. A low-privileged attacker can provide arbitrary userId , department id , and status va...

CVE-2026-108873

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the /sys/user/doUpdateDepartInfo endpoint. This vulnerability allows low-privileged authenticated users to modify any department by performing a PUT request. Specifically, an attacker can provide a depart...

CVE-2026-108872

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw in the batchEditUsers handler of the SysUserController. This vulnerability allows any authenticated user to send PUT requests to /sys/user/batchEditUsers using arbitrary user and department IDs. Consequent...

The vulnerability of the QAFA Firmware for telecommunications equipment lies in its ability to bypass authentication using a user-controlled key. This allows attackers to gain access to the administrative web console.

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

CVE-2026-108740

GoatCounter versions through 2.7.0 are vulnerable to a mass assignment privilege escalation flaw in the userPrefSave handler. This vulnerability allows authenticated users to modify protected account fields via form-encoded requests to the /user/pref endpoint. Specifically, an attacker with read-...

CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.accessall= and user.emailverified=true to...

CVE-2026-89305

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-103694

The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role...

adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

wssip

This repository does not have a README...

WPintel

विशेषताएँ • स्थापना • उपयोग • लाइसेंस • डाउनलोड वीडियो प्रदर्शन विशेषताएँ WordPress संस्करण का पता लगाएं संस्करण कमजोरियों का पता लगाएं उपयोगकर्ताओं की गणना करें थीम का पता लगाएं प्लगइन का पता लगाएं पूर्ण पथ प्रकटीकरण ढूंढें उपयोगकर्ता पंजीकरण स्थिति जांचें स्थापना Google Chrome उपयोगकर्ता WPinte...