CVE-2026-105485

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-105485: Authentication Bypass by Capture-replay

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA（WordPress 插件 miniorange-2-factor-authentication）≤ 6.3.0 — 通过电子邮件验证链接（userID / Txid / accessToken）实现未认证的任意 WordPress 选项删除。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。 python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGE...

Exploit for CVE-2026-77770

CVE-2026-77770 miniOrange 2FA CVE POC miniOrange 2FA WordPre...

CVE-2026-32616

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $SERVER'HTTPHOST' without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification lin...

HackerOne: Account Hijacking (Only rare case scenario)

Hi, This is a logical flaw in the application which may allow any arbitrary user to obtain account access of another user. Below is the exploit scenario which may lead to potential account takeover in certain circumstances: User changes email while he is logged in his own account Some wrong email...

Localize: Full path disclosure

I signed up for localize with [email protected], and localize sent me a verification link which was: http://www.localize.io/verify/e6be646b24pdd3w6d5c27ppa9a267ee7 When I visited that link I found it was showing the following error: Fatal error: Call to a member function...