CVE-2023-49978

CVE-2023-49978 Система поддержки клиентов 1.0 - Некорректный контроль доступа Описание : Некорректный контроль доступа в версии 1 Customer Support System позволяет пользователям, не являющимся администраторами, получать доступ к страницам администрирования и выполнять действия, зарезервированные...

CVE-2024-52302

CVE-2024-52302: Уязвимость неограниченной загрузки файлов в Common-User-Management Обзор Я обнаружил критическую уязвимость безопасности в common-user-management , мощном приложении на Spring Boot, предоставляющем службы управления пользователями для динамического контроля доступа. Эта уязвимость...

kratos

Чат · Обсуждения · Рассылка · Документация · Попробовать Ory Network · Вакансии Ory Kratos — это система управления идентификацией и пользователями, ориентированная на API, для облачных нативных приложений. Она централизует процессы входа, регистрации, восстановления, верификации и управления...

CVE-2020-24028

CVE-2020-24028 説明 ForLogic Qualiex v1 および v3 では、認証された任意の顧客が、ユーザー作成、パスワード変更、またはユーザー権限の更新を介して権限昇格を達成できます。 重要日付 ベンダーへの通知: 2020-07-12 公開日: 2020-08-31 脆弱性タイプ 安全でない権限 製品ベンダー ForLogic 影響を受ける製品コードベース Qualiex - v1 Qualiex - v3 他のバージョンも影響を受ける可能性があります（特に同じファミリー内のもの。未テスト） 影響を受けるコンポーネント Qualiex 攻撃タイプ リモート...

permission-manager

권한 관리자 Permission Manager 에 오신 것을 환영합니다! 🎉 🎉 Permission Manager는 SIGHUP에서 개발한 애플리케이션으로, Kubernetes를 위한 매우 쉽고 사용자 친화적인 RBAC 관리 를 가능하게 합니다. Kubernetes 클러스터 내에서 사용자를 관리할 수 있는 간단하고 직관적인 방법을 찾고 있다면, 바로 이곳입니다. Permission Manager를 사용하면 사용자를 생성하고, 네임스페이스/권한을 할당하며, 멋지고 간편한 웹 UI를 통해 Kubeconfig YAML 파일을 배포할...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

auth

Auth - Autenticación y gestión de usuarios de Supabase Auth es un servidor de autenticación y gestión de usuarios escrito en Go que impulsa las funciones de Supabase, como: Emisión de JWTs Seguridad a nivel de fila con PostgREST Gestión de usuarios Inicio de sesión con correo electrónico,...

CVE-2026-82488

A stored cross-site scripting vulnerability in the Beetel 450TC3 router (firmware 01.00.00_01 ) is triggered by manipulating the Username argument in the User Management component. An attacker with low privileges and requiring user interaction can execute scripts in a victim's browser, leading to...

EUVD-2026-68180

A vulnerability was identified in Beetel 450TC3 01.00.0001. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and...

CS-Remote-OPs-BOF

BOF de Operações Remotas Este repositório serve como um complemento ao nosso repositório SA lançado anteriormente. Nossa posição original era que não disponibilizaríamos nossas ferramentas que modificam outros sistemas, e forneceríamos apenas ferramentas de coleta de informações em um formato...

CVE-2020-24028

CVE-2020-24028 Beschreibung ForLogic Qualiex v1 und v3 ermöglicht jedem authentifizierten Kunden eine Privilegieneskalation durch Benutzererstellung, Passwortänderungen oder Aktualisierungen von Benutzerberechtigungen. Wichtige Daten Ankündigung an Anbieter: 2020-07-12 Datum der öffentlichen...

CVE-2023-37596

CVE-2023-37596 — issabel-pbx 4.0.0-6: Cross-Site-Request-Forgery CSRF — Beliebigen Benutzer löschen Schweregrad: Hoch | CVSS v3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | CWE: CWE-352 Inhaltsverzeichnis Übersicht Schwachstellendetails Auswirkungen Betroffene Version Angriffsszenario Proof of...

CVE-2023-34839

CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF zu Privilegieneskalation Inhaltsverzeichnis Übersicht Details zur Schwachstelle Betroffene Software CVSS-Score Angriffsszenario Proof of Concept PoC Schritte zum Reproduzieren Auswirkungen Behebung Referenzen Haftungsausschluss Übersicht CVE-2023-34839 i...

CVE-2025-25967

CVE-2025-25967: Cross-Site Request Forgery CSRF DDSN Interactive cm3 Acora CMS versione 10.1.1 è vulnerabile a Cross-Site Request Forgery CSRF. Questa falla consente agli attaccanti di indurre utenti autenticati a eseguire azioni non autorizzate, come l'eliminazione di account o la creazione di...

CVE-2026-29598

CVE-2026-29598: Cross-Site Scripting XSS persistente in cm3 Acora CMS versione 10.7.1. DDSN Interactive cm3 Acora CMS versione 10.7.1 contiene una vulnerabilità di Cross-Site Scripting XSS persistente nella funzionalità di gestione degli utenti. Un amministratore con la possibilità di aggiungere ...

CVE-2026-75419

go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...

CVE-2026-24167

NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosur...