CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82447

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

Exploit for CVE-2026-81578

Professional security research tool for PaperCut NG/MF vulne...

CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2026-82447

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2025-7461

CVE-2025-7461: Analisi della vulnerabilità di SQL Injection nel sistema di e-commerce Modern Bag 🌐 Lingua / 语言 : English | 简体中文 Panoramica della vulnerabilità Database delle vulnerabilità: https://vuldb.com/?id.316112 Sorgente del progetto:...

CVE-2022-1597

CVE-2022-1597 Das Plugin, das als Begleit-Plugin für die Themes Discy und Himer verwendet wird, bereinigt einen Parameter in seinem Passwort-Reset-Formular nicht und escaped ihn auch nicht, wodurch Reflected Cross-Site-Scripting-Angriffe ermöglicht werden. Betroffene Plugins: WPQA...

cve-2020-16012

Questo repository contiene PoC per CVE-2020-16012, una vulnerabilità di canale laterale nell'implementazione di CanvasRenderingContext2D.drawImage in Firefox e Chromium. Leggi un articolo su questa vulnerabilità sul blog Mozilla Attack & Defense. All'interno di benchmark si trova il codice per...

CVE-2022-21661

CVE-2022-21661 Exploit CVE-2022-21661 per skin personalizzata di Elementor...

CVE-2019-11581

Iniezione di template non autenticata in Atlassian Jira CVE-2019-11581 I Compilazione 1. Versioni vulnerabili root@kitploit: 4.4.x 5.x.x 6.x.x 7.0.x 7.1.x 7.2.x 7.3.x 7.4.x 7.5.x 7.6.x before 7.6.14 the fixed version for 7.6.x 7.7.x 7.8.x 7.9.x 7.10.x 7.11.x 7.12.x 7.13.x before 7.13.5 the fixed...

eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE

Exploit-Titel : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE Datum : 5/18/19 Exploit-Autor : liquidsky Joseph McPeters Verwundbare Software : eLabFTW 1.8.5 Anbieter-Webseite : https://www.elabftw.net/ Version : 1.8.5 Software-Link : https://doc.elabftw.net/ Getestet auf : Linux /...

-CVE-2018-0834-aab-aar

Shoutout an @reubensammut, du bist ein Tier. CVE-2018-0834 vollständige Codeausführung. Enthält statische Offsets, umgeht cfg,dep,aslr : viel Spaß...

CVE-2024-2961-Remote-File-Read

CVE-2024-2961 Remote-Datei-Lesen Dieses Skript demonstriert, wie eine Schwachstelle in Systemen ausgenutzt werden kann, die die iconv-Bibliothek verwenden, wenn sie Zeichenkodierungskonvertierungen fehlerhaft behandelt, wie in CVE-2024-2961 beschrieben. Es ermöglicht einem Angreifer, beliebige...

Better-CVE-2022-29464

Migliorato CVE-2022-29464 Alcuni prodotti WSO2 consentono il caricamento di file senza restrizioni, con conseguente esecuzione di codice in remoto. L'aggressore deve utilizzare un endpoint /fileupload con una sequenza di directory traversal in Content-Disposition per raggiungere una directory sot...