ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

Sunkaifei FlyCms Authorization Issue Vulnerability

The Sunkaifei FlyCms has an authorization issue. This vulnerability stems from the lack of authorization verification in the ActionService.counter function. Additionally, the checkRowOwner method does not validate ownership, allowing authenticated users to modify the content rows of other users...

openGauss-server Authorization Issue Vulnerability

Versions of openGauss-server from 3.0.0 to 3.0.5, from 3.1.0 to 3.1.1, 5.0.0-RC1, from 5.0.0 to 5.0.3, 5.1.0, 6.0.0-RC1, from 6.0.0 to 6.0.6, 7.0.0-RC1, 7.0.0-RC2, and 7.0.0-RC3 have an authorization issue vulnerability. This vulnerability stems from a flaw in the permission verification logic of...

openGauss-server Buffer Error Vulnerability

The openGauss-server versions 2.1.0, 3.0.0 to 3.0.6, 3.1.0, 5.0.0 to 5.0.5, 5.1.0, 6.0.0 to 6.0.6, 7.0.0-RC1, 7.0.0-RC2, and 7.0.0-RC3 have a buffer error vulnerability. This vulnerability arises from the HllObjectUnpack unpacking function, which does not verify the relationship between lenTotal...

Frappe CRM authorization issue vulnerability

Frappe CRM versions prior to 1.81.2 have an authorization issue vulnerability. This vulnerability stems from the lack of a permission hook, resulting in insufficient authorization checks. Certified Sales users can access the CRM notification records of other users. Attackers can query the...

MISP information leakage vulnerability

Versions of MISP 2.5.48 and earlier contain security vulnerabilities. These vulnerabilities stem from the setting search function in the server’s setup mechanism, which returns the entire configuration subtree when providing branch names instead of specific leaf settings. This bypasses masking...

Craft CMS authorization issue vulnerability

Craft CMS versions 5.0.0 to 5.11.0 have a vulnerability related to authorization. This vulnerability arises from the fact that the users/verify-email function does not invalidate verification codes for active users. Attackers can reuse these verification codes to bypass authentication. After the...

MISP Project: misp-modules input validation error vulnerability

The MISP Project’s misp-modules 3.0.12 and earlier versions have security vulnerabilities. These vulnerabilities stem from an incomplete BLOCKEDRANGES list in the issafeurl URL validation function of the htmltomarkdown extension. This oversight resulted in key IP address ranges being omitted,...

CVE-2022-38813

CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...

curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches

Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...

Ghidrathon

Ghidrathon Ghidrathon is a Ghidra extension that adds Python 3 scripting capabilities to Ghidra. Why? Ghidra natively supports scripting in Java and Jython. Unfortunately, many open-source analysis tools, like capa, Unicorn Engine, angr, etc., are written in Python 3 making it difficult, and in...

cpanel-cve-2026-41940

🔒 cPanel CVE-2026-41940 — Complete Security Toolkit Complete Security Toolkit for cPanel servers infected with CVE-2026-41940 / nuclear.x86. Two scripts — one full audit and one auto cleanup with Imunify360. Works on both original license and bypass/shared license servers. 👨‍💻 Author | ---|---...

CVE-2025-4126

POC-CVE-2025-4126 smart contract reentrancy attack vulnerability 验证 Smart Contract Reentrancy Attack PoC This repository contains a Proof of Concept PoC demonstrating a reentrancy attack vulnerability in Ethereum smart contracts. The PoC includes a vulnerable smart contract, an attacker contract,...

CVE-2022-44311

Out-Of-Bounds Read in html2xhtml : CVE-2022-44311 Summary Html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafte...

CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticated Arbitrary File Upload via Plugin Installation 🔥 Vulnerability Summary The WordPress theme Alone versions = 7.8.3 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to...

cve-2021-38314

cve-2021-38314 - Unauthenticated Sensitive Information Disclosure The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a giv...

CVE-2023-33246

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...

CVE-2024-50657

CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...

Exploit for CVE-2026-58221

CVE-2026-58221 — Samba AD Domain Takeover via LDB Special DN M...

ADC-19781

ADC-19781 Several checks for CVE-2019-19781 Module installation Download the two files ADC-19781.psd1 & ADC-19781.psm1 and put them in one of the following locations: C:\Users%USERNAME%\Documents\WindowsPowerShell\Modules\ADC-19781 C:\Program Files\WindowsPowerShell\Modules\ADC-19781 Import Modul...