ColdFusion_EXp

CVE-2023-29298/CVE-2023-26360 Vulnerability Exploitation Reverse Shell Tool Introduction The vulnerability principle is that when we construct CFML data, the client's request data is saved to the server's coldfusion-out.log. This directory records error information from requests. The...

CVE-2026-116749

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-116749

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.10 . The root cause is insufficient input sanitization and output escaping involving the 'className' block attribute. Specifically, while wp_kses...

CVE-2026-116749 VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-111596

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-127882

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Security Bulletin: MongoDB Enterprised Advanced affected by: Deserialization of Untrusted Data (CVE-2026-42778, CVE-2026-42779)

Summary There are vulnerabilities in mina-core-2.2.4.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-42778, CVE-2026-42779. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-42778 DESCRIPTION: The fix for CVE-2026-41409 was not applied to the 2.1.X...

Security Bulletin: IBM Bob Premium Package for i is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM Bob Premium Package for i. fast-uri can fail to canonicalize Unicode hostnames CVE-2026-13676. Hono Web Application framework can allow untrusted className values CVE-2026-59895, does not isolate context vales CVE-2026-59896, can drop distinct...

PT-2026-56505

Name of the Vulnerable Software and Affected Versions Hono versions 4.0.0 through 4.12.26 Description The cx function in hono/css composes class names from plain strings but marks the result as already escaped without performing HTML-escaping on the input. This allows untrusted className values...

CVE-2026-11583

A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/createClass.php. The manipulation of the argument className leads to sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-11583: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/createClass.php. The manipulation of the argument className leads to sql injection. It is possible to initiate the attack remotely. The exploit...

PT-2026-47444

A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/createClass.php. The manipulation of the argument className leads to sql injection. It is possible to initiate the attack remotely. The exploit...

Linux Distros Unpatched Vulnerability : CVE-2026-42779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass...

Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass

A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the AbstractIoBuffer.resolveClass method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing ...

CVE-2026-42779

A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass method, specifically when IoBuffer.getObject is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system...

OESA-2026-2243 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The fix for...

OESA-2026-2241 apache-mina security update

Apache MINA is a network application framework which helps users develop high performance and high scalability network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO. Security Fixes: The fix for...

CVE-2026-4658

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className, classHook, and blockId attributes in the Add to Cart block essential-blocks/add-to-cart in all versions up to, and including, 6.0.4. This...

Deserialization Vulnerability

Aache MINA is vulnerable to Unsafe Deserialization. The vulnerability is due to incomplete enforcement of a classname allowlist in AbstractIoBuffer.getObject, where deserialization occurs before validation, allowing execution of static initializers in malicious classes and potentially leading to...

CVE-2026-4658: Improper Neutralization of Input During Web Page Generation

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className, classHook, and blockId attributes in the Add to Cart block essential-blocks/add-to-cart in all versions up to, and including, 6.0.4. This...