Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 Título del Exploit: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Autor del Exploit: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM Referencias: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

snmpwn

SNMPwn is an SNMPv3 user enumerator and attack tool. It is a legitimate security tool designed to be used by security professionals and penetration testers against hosts you have permission to test. It takes advantage of the fact that SNMPv3 systems will respond with "Unknown user name" when an...

CVE-2021-46073

CVE-2021-46073 Título del Exploit: Vehicle Service Management System - 'User List' Cross Site Scripting Almacenado XSS Autor del Exploit: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIO Referencias: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

CVE-2026-90939

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint, which lacks proper permission annotations . Authenticated attackers can retrieve password hashes and personal data (email addresses, phone numbers) for users within their data scope, enabling...

CVE-2026-90689

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely...

PowerJob List - Authorization Bypass

PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges. id: CVE-2025-11580 info: name: PowerJob List - Authorization Bypass author: DhiyaneshDk severit...

GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...

PT-2026-77181

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set...

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...

EUVD-2026-60240

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-16595: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16578: Exposure of Sensitive Information to an Unauthorized Actor

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

EUVD-2026-42533

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...

CVE-2026-31983

CVE-2026-31983 describes a missing authentication vulnerability in the SSH keys synchronization endpoint. An unauthenticated attacker can query the SSH keys sync endpoint and obtain the list of users who uploaded public SSH keys, their groups, and the uploaded keys. Reported impacts include expos...

CVE-2026-31983

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...

PT-2026-56726

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...