CVE-2026-18810

The connected CVE record specifies: affected product is H3C NX15 V100R017; vulnerability exists in the /api/wizard/networkSetup function, where input manipulation leads to missing authentication, enabling remote attack. Reported CVSS scores in the documents indicate high impact (CVSS v3.1 base 7....

PT-2026-67828

Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A remote issue exists in the /api/wizard/networkSetup endpoint. Manipulation of an unknown function within this file allows an attacker to bypass authentication. Recommendations At the moment, there is no...

EUVD-2026-51563

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-59328

Summary: CVE-2026-59328 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue arises when the Spring Boot starter wizard’s dependency tooltips are rendered in a native embedded SWT Browser with JavaScript enabled, and untrusted/compromised Initializr endpoints are used. This can allow a...

cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

ITFlow Unfinished Installation Detection

Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configure the database and create an admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configur...

Homebridge - Unfinished Installation Detection

Homebridge instance with incomplete installation detected. The setup wizard is exposed, allowing anyone to create the first admin account and gain full control over the Homebridge instance. This can lead to unauthorized access to smart home devices and potential network compromise. !/usr/bin/env...

Ghost CMS Installation Setup - Exposure Detection

Detected Ghost CMS installation setup wizard accessible without authentication. An unauthenticated remote attacker can navigate to /ghost//setup and complete the installation to gain full owner-level administrative control of the site. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Ghost C...

Icinga Web 2 Installer Exposure Detection

Icinga Web 2 installer/setup wizard is publicly accessible. The setup page at /icingaweb2/setup exposes the configuration wizard which guides through full application configuration including database credentials, authentication backends, and admin account creation. While a setup token is required...

SABnzbd Quick-Start Wizard - Exposure Detection

Default installation wizard page of SABnzbd was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Default installation wizard page of SABnzbd was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Revive Adserver - Exposed Installer Detection

Detected exposed Revive Adserver installation wizard that allows unauthorized installation and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Revive Adserver installation wizard that allows unauthorized installation and configuration.""" from kittysploit import from...

UniFi Wizard Installer Detection

UniFi Wizard is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """UniFi Wizard is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Craft CMS Installation Wizard Exposure Detection

Detected Craft CMS installation wizard was exposed, allowing attackers to complete the installation process and gain administrative access to the CMS. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Craft CMS installation wizard was exposed, allowing attackers to complete the installation...

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition Detection

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

Trendnet AC2600 TEW-827DRU - Credentials Disclosure Detection

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page. !/usr/bin/env python3 -- coding: utf-8 -- """Trendnet...

AzuraCast - Unfinished Installation Detection

Detected exposed AzuraCast setup wizard that allows unauthorized superuser account creation.An unfinished AzuraCast installation exposes setup endpoints that enable attackers to create administrator accounts and gain full control of the application. !/usr/bin/env python3 -- coding: utf-8 --...

Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion Detection

A directory traversal vulnerability in the Dione Form Wizard aka FDione or comdioneformwizard component 1.0.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

ConnectWise Setup Wizard - Exposure Detection

Detects ConnectWise Setup Wizard - Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Setup Wizard - Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ConnectWise Setup Wizard - Exposu...

ioncube Loader Wizard Disclosure Detection

An ioncube Loader Wizard was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An ioncube Loader Wizard was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ioncube Loader Wizard Disclosure...