CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronization SQL Injection Exploit Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 wp2shell vulnerability. Vulnerability Information CVE : CVE-2026-63030 wp2shell Companion CVE : CVE-2026-60137 Type : Pre-Auth...

EPScalate

EPScalate An elevation of privilege vulnerability in QuickHeal's Seqrite Enterprise Endpoint Security Solution EPS. The vulnerability has been assigned a CVE ID of CVE-2023-31497. https://user-images.githubusercontent.com/39941993/230790056-87157751-b96c-49a6-81df-bf3126acfbd6.mp4 Vendor and...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd First, obtain the SessionID for a guest user. We can find the SessionID from any http request. Such as: POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: ULONG64 leaked = ULONG64 desktopheap + 0x100...

CVE-2026-13152

CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...

CVE-2026-109172

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109165

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-108951

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...

CVE-2017-11427-DEMO

CVE-2017-11427-DEMO Basic Environment $ sudo apt-get install libxml2-dev libxslt1-dev $ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl DEMO: $ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git $ cd CVE-2017-11427-DEMO $ source venv/bin/active $ cd vulnsaml $ python...

CVE-2026-109186 jshERP through 3.6 Mass Assignment via PUT /user/update

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...

CVE-2026-109185 jshERP through 3.6 Privilege Escalation via PUT /user/updateUser

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebin...

CVE-2026-109172

The yshop-crm software, versions through 2.1.3 , is vulnerable to a missing authorization flaw (CWE-862). The issue exists in the POST /admin-api/crm/contract-receivables/check endpoint, where the handler lacks a @PreAuthorize check. Furthermore, the required approver validation within CrmContrac...

EUVD-2026-97376

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109172 yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109171

The yshop-crm software, version 2.1.3 and below , is vulnerable to a missing authorization flaw. The root cause is that the CrmContractController lacks the @PreAuthorize annotation and has its approver checks commented out. This allows any authenticated back-office user to call the POST /admin-ap...

EUVD-2026-97375

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2026-109167 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey,...

EUVD-2026-97371

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-109165

The TDuck survey form (through version 6.0 ) is vulnerable to a broken access control issue (CWE-639) in the POST /user/form/item/batch/create endpoint. This flaw allows authenticated users to inject arbitrary fields into other users' forms by submitting an array where the first element reference...

CVE-2026-109165 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...