CVE-2026-77136

CVE-2026-77136 is a Server-Side Template Injection (SSTI) in the TYPO3 extension powermail (in2code). The raw value of a form field configured as the sender name is passed directly into a Fluid template without sanitization, allowing an unauthenticated user to inject Fluid template syntax and exe...

CVE-2026-77138

CVE-2026-77138 affects the TYPO3 extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) . The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safe processing, enabling PHP Object Injection . A remote, unauthenticated attacker can supply a ...

CVE-2026-77138 Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

EUVD-2026-65338

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-63586 Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

CVE-2026-63586

CVE-2026-63586 is a critical (CVSS 3.1: 9.8) unauthenticated remote code execution vulnerability in a web-based management interface that uses a modified uhttpd server with CGI shell scripts. The root cause is a shell injection flaw: the HTTP Basic Authentication username is taken directly from t...

L4J-Vuln-Patch

AVVISO Questo strumento non è più necessario, Mojang ha rilasciato una propria patch che dovrebbe coprire tutti i soggetti interessati https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition ATTENZIONE QUESTA VULNERABILITÀ COLPISCE SIA I CLIENT CHE I SERVER...

ApacheRCEEssay

CVE-2021-41773 Saggio 🕸️ Descrizione 🖼️ Questo repository contiene un saggio su CVE-2021-41773, una vulnerabilità di esecuzione di codice remoto in Apache 2.4.49. È stato creato per un corso della Facoltà di Automatica e Calcolatori, Università POLITEHNICA di Bucarest, denominato "Cyberdefences and...

Detections-CVE-2026-23918

MIGRAZIONE VERSO: https://github.com/insomnisec/publiccvedetections PER UNA MIGLIORE GESTIONE A LUNGO TERMINE DELLE PUBBLICAZIONI DI DETECTION QUESTO REPO VERRÀ RIMOSSO A GIUGNO 2026 PER FAVORE UTILIZZA L'ALTRO REPO D'ORA IN POI CVE-2026-23918 "Apache HTTP/2 Double-Free" — Pacchetto di Rilevament...

CVE-2026-16601

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

EUVD-2026-65313

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2026-16601

CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...

CVE-2026-16601 CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2025-10147

CVE-2025-10147 Podlove Podcast Publisher = 4.2.6 - Caricamento Arbitrario di File Non Autenticato Il plugin Podlove Podcast Publisher per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza di validazione del tipo di file nella funzione 'moveasoriginalfile' in tutte le...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68960

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has th...

EUVD-2026-65310

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68959

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability caused by an incomplete fix for CVE-2024-41726. An attacker who can log in to a Windows system with the affected product installed may execute arbitrary code on another Windows system that also has the product install...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65309

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...